Cloud · Cloud Security
Shared Responsibility Model
The division of security duties between cloud provider and customer, which shifts with each service model.
FoundationalUpdated 2026-09-01
Overview
Providers secure the cloud, facilities, hardware, hypervisors, managed service internals. Customers secure what they put in the cloud, identities, permissions, configuration, data, classification and application code. The line moves depending on whether you consume IaaS, PaaS or SaaS.
Most cloud incidents occur on the customer side of the line, and almost always through identity or configuration rather than provider failure. Stating the boundary explicitly per workload prevents assumed coverage.
Layer model
Always the customer's responsibility
Identity and access managementData classification and protectionConfiguration of the services usedClient and endpoint securityBackup and retention policy decisions
Shared, varying by model
Operating system patchingNetwork controlsApplication layer controlsEncryption key managementAvailability design
Always the provider's responsibility
Physical facilitiesHardware and firmwareHypervisor and host isolationGlobal network backboneManaged service internals
Security considerations
- Confirm backup and retention explicitly for SaaS, 'the provider has redundancy' is not the same as 'we can recover deleted or maliciously encrypted data'.
- Document per service responsibility in the architecture record so audits and incidents do not begin with a debate.
Common misconfigurations
- Assuming provider redundancy covers accidental or malicious deletion.
- Assuming a managed database is patched at the schema and credential level.
- Assuming SaaS audit logs are retained long enough for investigation without an added licence.