Using a cloud service changes who runs the technology, but it does not remove every security task from your team. The provider may manage physical infrastructure and parts of the platform. You still need to understand your accounts, settings, information, and responsibilities under the specific service.
Understand the idea
Ask who controls each important layer. This differs between a hosted application, a managed platform, and a virtual server. Record responsibilities for updates, access, backups, monitoring, and incident communication. “The provider handles security” is too broad to tell a service owner what they must actually do.
- Service
Identify the cloud service and its documented boundary.
- Owner
Assign each important control to a responsible party.
- Evidence
Check that the control is actually operating.
A practical example
Imagine an NGO moving a database to a managed cloud service. The provider maintains the platform, while the NGO still controls user access and public connectivity. The team reviews those settings and tests recovery instead of assuming the migration made the data private and recoverable automatically.
What to do next
- Name the service model. Identify whether you operate a virtual server, a managed platform, or a hosted application. Read the responsibilities for that specific service.
- Assign the customer tasks. Name owners for identity, sharing, data handling, backups, and any software or network settings your team controls.
- Check provider features. Confirm what your subscription includes and what must be enabled or configured.
- Test the important outcomes. Verify access and recovery with real service settings and controlled data. Keep the result with the responsibility record.
How to check the result
Turn the responsibility split into named tasks with evidence. Confirm the relevant provider features and test the settings your team owns on the service you actually use.
The provider runs the database. Who controls our application’s access?
Your organization still needs to review its accounts, credentials, permissions, and configuration within the provider’s model. Confirm the exact boundary in the service documentation.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
