Cloud
Shared responsibility: what your cloud provider will not do for you
Cloud providers secure the cloud. Agencies secure what they put in it. The line between those matters in an audit.
Every major cloud provider publishes a shared responsibility model. The provider is responsible for the physical facilities, the hardware, and the underlying services. The customer is responsible for how they configure and use those services. The details vary by service type, and misunderstanding them is behind many cloud incidents.
What the provider handles
- Physical security of data centers
- Hardware and network infrastructure
- The security of the managed services themselves
- Compliance certifications for the platform, such as FedRAMP or StateRAMP authorizations
What the agency handles
- Identity and access: who can do what
- Configuration: storage buckets that are not public, databases that are not open to the internet
- Data: classification, encryption keys, retention, and backup
- Operating systems and applications on virtual machines, including patching
- Logging and monitoring of activity
- Network design within the cloud environment
Where it goes wrong
A StateRAMP authorized platform does not make an agency's misconfigured storage bucket compliant. A managed database still needs its access rules set correctly. Backups are the customer's responsibility unless a specific service includes them.
What to do
Write down, for each service you use, which side of the line each control falls on. Include your managed service provider if you have one; three-party responsibility models are common and are where gaps hide. Keep that document with your security program and update it when services change.
How this shows up in HQT's work
Every environment we build comes with a responsibility matrix covering the provider, the agency, and HQT. It answers audit questions before they are asked and prevents the assumption that someone else is doing the backups.