Shared Responsibility Model

The shared responsibility model defines which security controls a cloud provider operates and which the customer must implement themselves. For IaaS, the provider secures the physical data centre, hypervisor, and core network, while the customer is responsible for guest OS patching, IAM, network configuration, encryption, and application code. For PaaS and SaaS, the provider absorbs more layers, but customer obligations such as identity, data classification, sharing settings, and integration security remain. Misunderstanding these boundaries is a leading cause of cloud breaches: customers often assume the provider secures workloads or data when it does not. Each major provider (AWS, Azure, GCP) publishes a model that should drive cloud control mappings.