This is required for companies that require data is not exported outside of the US.
The reason behind this ask is to control the traffic of where controlled unclassified
information goes, hence International Traffic in Arms Regulations.
The request is for Bitbucket data at rest not to be hosted outside of US and although this is already in place at this moment, the certification is a must for these companies to use the product.