The reference desk / In practice

Shared responsibility

The split of security duties between a cloud or SaaS provider and the customer, which varies by service.

What it means

Using a hosted service changes who performs security work; it does not make the work disappear. The division depends on the particular service and agreement. A provider may operate facilities, hardware, and parts of the software stack while the customer manages identities, data, permissions, and configuration. A managed database and a rented virtual machine usually leave different tasks to the customer. Responsibility should be translated into named activities and owners, including detection, backup, recovery, and incident communication, rather than reduced to a generic cloud diagram.

AN ILLUSTRATIVE SCENARIO

A retailer moves its ordering system

A retailer replaces a self-managed database with a managed service. The provider now performs specified database maintenance, but the retailer still controls which application identities can read customer addresses. The team also chooses retention settings and tests how to restore an order. During a review, they discover that the service's default audit configuration does not capture an event their investigators need. They enable the relevant logging and assign someone to monitor it; the hosting arrangement did not make that decision for them.

Put it to work

  1. Read the documentation and contract for the exact service and deployment. List operational tasks such as patching, access reviews, encryption-key handling, logging, retention, and restoration.
  2. Assign a customer owner to every task that remains yours, and document the provider's commitments and dependencies. Clarify notification timelines, support access, and actions required during an incident.
  3. Test critical assumptions with the configured service. Revisit the responsibility record whenever the service tier, architecture, integration, data sensitivity, or contractual terms change.

How to check your work

Choose an account compromise or accidental deletion scenario and walk through who detects it, who acts, and what evidence each side supplies. Demonstrate the customer-owned steps using test data, including access revocation and recovery.

Connect the ideas

  • Backup

    A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.

  • Authorization

    The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.

  • GRC

    The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.

Explore a field lesson

Find your next idea.

Tip: press / to open search. Escape closes this window.