Same principles. Different consequences.
These exercises use Harborline, a fictional multi-tenant CRM, and fictional customers. The Cloud Controls Matrix is a framework, not a statute. Privacy, breach notice, and contract duties depend on the parties, the agreement, and the jurisdiction. A CAIQ answer is questionnaire evidence, not an audit opinion, and this path does not invent a SOC 2 report for any named product.
Many customers share one product
A multi-tenant CRM can store several customers in one application. A control that is enough inside one company can still leak another customer’s records. Isolation is a claim about that boundary, and a questionnaire answer is not the same thing as a test of the boundary.
Machine identities outlive the person who clicked consent
API keys, sync accounts, and OAuth application grants keep working after the meeting ends. The blast radius is every tenant and action that credential can reach, not the sentence on the consent screen.
The customer still configures the product
On software as a service, the provider usually runs the application. The customer still chooses single sign-on, directory sync, administrator roles, exports, and the exit copy. A healthy platform does not restore a bad customer configuration.
How to use this path
Read each situation, inspect the synthetic evidence, and choose a response. Every answer explains its tradeoffs. Follow the linked foundation lessons when you need a concept explained, then mark the decision practiced when you are ready.
All organizations, people, events, and evidence in these exercises are fictional. The controls stay in the browser.
APPLIED LESSON 1 / 8 MIN
Prove a tenant isolation claim
Map provider, customer, and shared duties, then split a cross-tenant symptom from an in-tenant mistake.
Harborline is a fictional CRM used by Lumen Clinic and Pinetop Freight. A reviewer has three artifacts: a CAIQ-style row that answers yes to tenant segregation, an architecture note that says the database is pooled with a tenant column, and a ticket in which a Lumen user saw a Pinetop contact name. CSA’s Cloud Controls Matrix v4.1, described in the Introductory Guidance released 13 February 2026, is a framework of 207 controls. Its CAIQ is a set of yes/no questions, not an audit. Control IVS-06, Segmentation and Segregation, says applications and infrastructure should be designed so tenant access is segmented and restricted from other tenants. A CSA article of 27 June 2025 describes that control as dependently shared for IaaS and PaaS and owned by the provider for SaaS. The 2026 guidance says the matrix marks each control CSP-Owned, CSC-Owned, or Shared, and that the real split still depends on the service.
Shared and isolated are different designs. AWS’s SaaS Tenant Isolation Strategies whitepaper, published 1 August 2020 and marked historical on the current AWS documentation page, is vendor guidance, not a standard. It describes silo, pool, and bridge patterns. Harborline’s note describes a pool. A pool can isolate tenants, but a CAIQ yes does not prove the tenant column is enforced or that an operator can read only one customer. Split the symptom. A Pinetop contact visible inside Lumen’s session is first a provider isolation question under a SaaS reading of IVS-06. A share or export that stays inside Lumen is a customer configuration question. Preserve both records and do not close one as proof about the other.
How should the reviewer map this SaaS CRM and triage ticket T-19?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 2 / 8 MIN
Bound service identities and their blast radius
Separate a customer OAuth consent from a provider-wide machine credential.
Pinetop’s administrator consented to a billing integration. The screen said read contacts. The credential Harborline issued is a long-lived API key on the operator account harborline-sync, and that account can export every tenant. A copy of the same key sits on a shared wiki with no expiry. A machine user, an API key, and an OAuth consent are different subjects. Consent by one customer administrator is not authority for the provider’s operator plane. Least privilege still names who acts, on which records, and until when.
Blast radius is every customer and action reachable if the key is copied. This key reaches Lumen and Pinetop. A customer-scoped token should have reached only Pinetop and should have been revocable by Pinetop. The CCM identity and access domain, as summarized in the 2026 introductory guidance, expects the provider to supply access capabilities and the customer to define roles, require strong authentication, and manage the identity lifecycle. NIST SP 800-210 offers general access-control guidance for cloud systems; it does not approve a product. Revoke the shared operator key, issue a Pinetop-scoped credential with an owner and an end date, and do not paper over the gap with an invented audit report.
What is the best next control on this integration?
CONNECT TO THE FUNDAMENTALS
APPLIED LESSON 3 / 8 MIN
Recover one tenant’s configuration and exit copy
Restore a single customer after an administrator-role incident without rolling back other tenants.
Pinetop connects Harborline to its own identity provider. Single sign-on lets staff in. SCIM provisioning adds and removes CRM users when the directory changes. A temporary project group was given the CRM administrator role, so members can export all of Pinetop’s contacts and change sign-on settings. An export runs, and a bad mapping then disables the legitimate administrators. Harborline’s platform status is healthy, and Lumen is unaffected. The 2026 CCM introductory guidance treats business continuity as shared work: the provider explains recovery capabilities, and the customer plans for its own data. Portability guidance expects the customer to use the provider’s transfer and restore tools and to document how it will leave.
Restore the tenant, not the pool. If the agreement and a tested copy allow it, the provider can return Pinetop’s records from before the export. Restoring the whole database would rewrite Lumen as well. Pinetop still owns the configuration it chose: the identity provider, the SCIM groups, the administrator role, and a customer-held exit file. Replaying the old directory group would recreate the broad role, so correct that group before sync resumes. Refresh the exit export after recovery. What Pinetop must tell people or regulators depends on jurisdiction and is outside this exercise. A green status page does not put the administrator role back correctly.
What should happen before Pinetop is reopened?
CONNECT TO THE FUNDAMENTALS
Standards & scope
These are signposts for further study. The examples use U.S. regulatory context where noted; applicability depends on your organization, jurisdiction, services, and data.
CSA Cloud Controls Matrix v4.1 and CAIQ ↗
CCM v4.1 is a cloud control framework of 207 controls. IVS-06 is Segmentation and Segregation. The CAIQ is a yes/no questionnaire used with the matrix. An answer is evidence to read, not an audit opinion or a certificate.
CSA Introductory Guidance to CCM v4.1 (SSRM) ↗
Released 13 February 2026. It explains CSP-Owned, CSC-Owned, and Shared markings by service model, and it states that ownership still varies by the actual service. It is framework guidance, not a statute.
AWS SaaS Tenant Isolation Strategies ↗
Vendor guidance only, published 1 August 2020. The current AWS documentation page marks the whitepaper as historical reference. Silo, pool, and bridge are architecture patterns from that paper, not a standard and not proof that a named product isolates tenants.
NIST SP 800-210 ↗
General access-control guidance for cloud systems. Use it for identity and authorization concepts. It is not a SaaS product checklist and it does not certify a vendor.