What it means
Some controls are inherited from the provider, some are shared, and others are entirely customer operated. Evidence must show that the organization's portion is effective in the actual environment.
Why it matters
Cloud environments change too quickly for screenshots collected once a year to provide strong assurance. Repeatable evidence collection is more reliable and less disruptive.
Practical focus
- Map each requirement to owner, control, system, and evidence source
- Use APIs and policy tools for repeatable collection
- Preserve time, account, region, and resource context
- Review provider assurance reports for scope and exceptions
Common mistakes
- Submitting provider certifications as proof of customer configuration
- Collecting screenshots with no provenance
- Ignoring inherited-control limitations
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: