Cloud providers secure and operate parts of their platforms, but the customer still has responsibilities. The exact split depends on the provider, service and configuration. A virtual machine, managed database and software-as-a-service application do not assign the same operational work to the customer. Before relying on a broad statement such as “the provider handles security”, identify the service model and read the provider’s responsibility guidance for the specific service.
Responsibility changes by service model
In an infrastructure-as-a-service environment, the provider operates the underlying facilities and hardware, while the customer generally has more responsibility for operating systems, applications, network rules and workload configuration. With platform services, the provider manages more of the underlying stack, but the customer still configures the application, identities and data access. With software as a service, the provider operates the application platform, while the customer continues to manage users, permissions, data and many configuration choices.
These are broad patterns, not a universal matrix. AWS says customer responsibilities depend on the services selected and describes a distinction between security “of” the cloud and security “in” the cloud.AWS Shared Responsibility Model Microsoft’s Azure documentation lists responsibilities by deployment model and states that customers retain responsibility for data and identities across those models.Microsoft’s Azure shared responsibility guidance Google Cloud also explains that customer and provider duties vary by service type and configuration.Google Cloud shared responsibility guidance
Identity and access remain important
A provider cannot decide which people in your organisation should have access to your information. The organisation needs to manage account creation, role assignment, authentication, privileged access and removal when a person’s role changes or ends. It also needs to consider service accounts and other non-human identities used by applications or automation.
Review permissions against current responsibilities. Identify accounts with administrative access, inactive accounts and permissions that were granted for a temporary task. Decide how access reviews are recorded and who approves exceptions. Where identity configuration is managed by a provider, agree which tasks it performs and which decisions remain with your organisation.
Data and configuration require customer decisions
Cloud services can provide encryption options, logging, retention settings and access controls, but the organisation must choose how to use them. It should classify information, decide who may access it, set retention and sharing rules, and understand the effect of configuration choices.
A setting can be technically available but unsuitable for a business requirement. Changes to storage exposure, network access, authentication or data retention should have an owner and an approval path. Keep a record of significant configuration decisions and review them when the workload changes.
Endpoints and workloads still need attention
Employees access cloud services through devices, browsers and applications. The organisation must decide how those endpoints are managed, protected and kept in line with its requirements. If it runs virtual machines or containers, it may also have responsibility for operating systems, workload software, patching and runtime configuration, depending on the service.
A managed service provider may help operate some of these controls, but that does not transfer legal or business accountability automatically. The contract should say what is monitored, what changes the provider can make, how incidents are escalated and what evidence or reporting is provided.
Understand logging, incident response and recovery
Cloud logs can help an organisation investigate activity, but it must decide which logs to enable, how long to retain them, who reviews alerts and how an incident is escalated. Some services have provider-managed security features; the customer still needs to understand the coverage, configure the feature and decide how the resulting alert is handled.
Recovery also needs planning. Confirm what is backed up, how often it is protected, who can access backups and how restoration is tested. Do not assume that a cloud provider’s platform resilience is the same as a customer backup or recovery plan for a particular dataset or application.
Map responsibilities to each workload
Create a simple inventory of cloud services, service models, data owners, identities, configuration responsibilities, monitoring, recovery and support contacts. For each control, mark whether the provider manages it, the customer manages it, or both parties have distinct parts. Link to the relevant agreement and current provider documentation.
Review the map when a service changes, a new workload is deployed or the organisation changes providers. Ask the provider or service partner to explain how a responsibility is implemented for your specific service, rather than relying on a generic diagram.
Keep accountability clear
Cloud providers can deliver secure infrastructure and managed services, but the customer still makes important decisions about data, identities, configuration and use. The practical task is to understand the boundary for each service and assign an owner to the customer responsibilities that remain.
Read how identity controls shape access and what platform management should cover. For AltTab’s current cloud and workplace assessment and support scope, see Cloud and Microsoft services.