In cloud services, what is the shared responsibility model?

In cloud services, what is the shared responsibility model?

• A. The customer is responsible for all security tasks in the cloud.
• B. Security is only managed by the cloud provider; customers have no security duties.
• C. Cloud provider handles security of the cloud; customer handles security in the cloud (data, access, config).
• D. Both parties share the same exact responsibilities with no distinction.

Answer: (C)

The shared responsibility model divides security tasks between the cloud provider and the customer. The provider is responsible for security of the cloud — the underlying infrastructure, including physical data centers, networking, virtualization, and the foundational controls that keep the cloud platform itself secure. The customer is responsible for security in the cloud — protecting their data and how they use the cloud: data encryption and protection, identity and access management, secure configurations, application security, and monitoring for their workloads. The exact split shifts with the service model (IaaS, PaaS, SaaS), but the pattern is consistent: the provider handles the cloud’s security, while the customer handles the security of their data, access, and configurations.

The shared responsibility model divides security tasks between the cloud provider and the customer. The provider is responsible for security of the cloud — the underlying infrastructure, including physical data centers, networking, virtualization, and the foundational controls that keep the cloud platform itself secure. The customer is responsible for security in the cloud — protecting their data and how they use the cloud: data encryption and protection, identity and access management, secure configurations, application security, and monitoring for their workloads. The exact split shifts with the service model (IaaS, PaaS, SaaS), but the pattern is consistent: the provider handles the cloud’s security, while the customer handles the security of their data, access, and configurations.