Model Overview
The SRM is a responsibility matrix that maps security controls to the cloud provider (infrastructure, physical, and core services) and the customer (data, applications, identity, and governance). It is the foundation for risk‑based cloud security strategy.
Service‑Model Breakdown
Responsibilities shift as you move from Infrastructure‑as‑a‑Service (IaaS) to Platform‑as‑a‑Service (PaaS) and Software‑as‑a‑Service (SaaS).
- IaaS – Customer controls OS, middleware, runtime, data, and access management.
- PaaS – Provider adds control of runtime and middleware; customer retains data, application, and IAM.
- SaaS – Provider manages the entire stack; customer focuses on data, user access, and compliance.
Responsibility Matrix (Core Control Categories)
Key security domains are split between provider and customer. The matrix drives governance and audit focus.
- Physical & Facility Security – Provider
- Network Infrastructure & Segmentation – Provider (IaaS/PaaS) / Shared (SaaS)
- Host Operating System – Customer (IaaS) / Provider (PaaS, SaaS)
- Virtualization Layer – Provider
- Runtime & Middleware – Provider (PaaS) / Customer (IaaS)
- Application Code – Customer
- Data (at rest & in transit) – Shared (encryption responsibilities)
- Identity & Access Management – Customer (principle of least privilege)
- Configuration Management – Shared (provider defaults vs. customer hardening)
- Compliance & Auditing – Shared (provider attestations, customer evidence)
Governance & Risk Implications
Aligning internal policies with the SRM prevents gaps. Critical actions include mapping internal control frameworks (e.g., NIST CSF, ISO 27001) to the matrix, defining SLA‑linked security metrics, and establishing joint‑ownership dashboards.
Executive Actions
Prioritized steps for CIOs, CISOs, and IT Directors.
- Conduct a gap analysis against the SRM for each cloud service model in use.
- Document and formalize responsibility contracts in cloud‑service agreements.
- Implement continuous monitoring of customer‑owned controls (e.g., CSPM, IAM hygiene).
- Integrate provider security attestations (SOC 2, ISO 27017) into your risk register.
- Establish a shared‑ownership governance board with the provider’s security liaison.