What it means
Using a hosted service changes who performs security work; it does not make the work disappear. The division depends on the particular service and agreement. A provider may operate facilities, hardware, and parts of the software stack while the customer manages identities, data, permissions, and configuration. A managed database and a rented virtual machine usually leave different tasks to the customer. Responsibility should be translated into named activities and owners, including detection, backup, recovery, and incident communication, rather than reduced to a generic cloud diagram.
AN ILLUSTRATIVE SCENARIO
A retailer moves its ordering system
A retailer replaces a self-managed database with a managed service. The provider now performs specified database maintenance, but the retailer still controls which application identities can read customer addresses. The team also chooses retention settings and tests how to restore an order. During a review, they discover that the service's default audit configuration does not capture an event their investigators need. They enable the relevant logging and assign someone to monitor it; the hosting arrangement did not make that decision for them.
Put it to work
- Read the documentation and contract for the exact service and deployment. List operational tasks such as patching, access reviews, encryption-key handling, logging, retention, and restoration.
- Assign a customer owner to every task that remains yours, and document the provider's commitments and dependencies. Clarify notification timelines, support access, and actions required during an incident.
- Test critical assumptions with the configured service. Revisit the responsibility record whenever the service tier, architecture, integration, data sensitivity, or contractual terms change.
How to check your work
Choose an account compromise or accidental deletion scenario and walk through who detects it, who acts, and what evidence each side supplies. Demonstrate the customer-owned steps using test data, including access revocation and recovery.
Connect the ideas
- Backup
A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- GRC
The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.