In cloud security, what does shared responsibility imply?

• A. The provider is fully responsible for all security controls in the cloud.
• B. Both provider and customer share duties; responsibilities must be clearly defined and managed.
• C. Security is solely the customer's responsibility, regardless of cloud model.
• D. Only physical security is the shared duty.

Answer: (B)

Shared responsibility means security duties are shared between the cloud provider and the customer, with clear boundaries defined for what each party must protect. The provider handles security of the cloud itself—physical data centers, network infrastructure, hardware, and the foundational services they offer. The customer handles security in the cloud—protecting data, managing encryption keys and data classification, configuring access controls, securing applications, and monitoring for threats within their environment. The exact split depends on the service model, but the key point is that both sides have roles and responsibilities that must be explicitly defined and managed to avoid gaps. This is why the correct answer emphasizes that duties are shared and must be clearly defined and managed.