Which term best describes the concept where security responsibilities are shared between customer and cloud service provider?

Which term best describes the concept where security responsibilities are shared between customer and cloud service provider?

• A. Shared responsibility model
• B. Responsibility matrix
• C. Security governance plan
• D. Data ownership matrix

Answer: (B)

In cloud security, duties are split between the provider and the customer, and this division is described by the shared responsibility model. It makes clear which security controls the cloud provider is responsible for—such as the underlying infrastructure, physical security, network, and foundational services—and which controls the customer must handle—like data protection, access control, identity management, configuration of services, and securing applications. This split varies with the type of cloud service: IaaS tends to leave more security work to the customer for guest operating systems and applications, while SaaS shifts more responsibility to the provider but still requires the customer to manage data and access. The phrase “shared responsibility model” is the standard term used across cloud security frameworks and practice to capture this collaborative security duty. Other terms describe related ideas but not the same concept. A responsibility matrix is a general tool that maps tasks to owners and isn’t specific to cloud security sharing. A security governance plan outlines how security decisions are made and overseen, not the split of duties between provider and customer. A data ownership matrix focuses on who owns data, not who is responsible for securing it within the cloud.

In cloud security, duties are split between the provider and the customer, and this division is described by the shared responsibility model. It makes clear which security controls the cloud provider is responsible for—such as the underlying infrastructure, physical security, network, and foundational services—and which controls the customer must handle—like data protection, access control, identity management, configuration of services, and securing applications. This split varies with the type of cloud service: IaaS tends to leave more security work to the customer for guest operating systems and applications, while SaaS shifts more responsibility to the provider but still requires the customer to manage data and access. The phrase “shared responsibility model” is the standard term used across cloud security frameworks and practice to capture this collaborative security duty.

Other terms describe related ideas but not the same concept. A responsibility matrix is a general tool that maps tasks to owners and isn’t specific to cloud security sharing. A security governance plan outlines how security decisions are made and overseen, not the split of duties between provider and customer. A data ownership matrix focuses on who owns data, not who is responsible for securing it within the cloud.