Framework defining security responsibilities split between cloud providers and customers.
The shared responsibility model defines which security aspects cloud providers manage versus customer responsibilities. Providers secure infrastructure—physical facilities, hypervisors, and foundational services. Customers secure their data, identities, access, configurations, and workloads. Responsibility varies by service type: IaaS requires customers to secure more (operating systems, network), while SaaS providers handle most security except data and access. Misunderstanding shared responsibility causes many cloud security failures.
Why It Matters
The DSC Perspective:
Cloud doesn't mean the provider handles all security. You remain responsible for your data, access controls, and configurations. Understanding shared responsibility prevents dangerous assumptions about what the provider secures.