Core idea
The provider secures parts of the cloud service, while the customer secures its use of that service. The exact boundary changes across infrastructure, platform, software, and managed services.
Common customer responsibilities
- Identity, access, and privileged administration
- Data classification, configuration, and protection
- Application and workload security
- Logging, monitoring, and incident response
- Network and exposure settings
- Vendor and service selection
What changes by service model
As more of the technology stack is managed by the provider, the customer usually performs less infrastructure work but still makes critical decisions about data, identities, configuration, integration, and use.
Common mistake
“The provider handles security” is incomplete. A secure cloud platform can still be exposed through weak identity, public storage, excessive permission, unsafe application design, or missing monitoring.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: