The cloud shared responsibility model is the split of security work between a cloud provider and the business that uses it. The provider looks after the data centres and the platform it runs; you look after your data, your user accounts and the settings you control. How much sits on each side depends on whether you rent ready-made software, a platform or raw infrastructure, but Microsoft, AWS and Google all say the same thing about one part of it: your data and your accounts stay your job in every model.
Our earlier guide on moving your business to the cloud in stages covers the move itself. This guide is about what happens after the move: who is answerable when something goes wrong, and what your business still has to do.
What the shared responsibility model means
When your files sat on a server in the back office, every part of keeping them safe was yours: the building, the hardware, the operating system, the software, the backups and the passwords. Moving to the cloud hands some of that list to the provider. It does not hand over all of it.
Microsoft puts it plainly in its guide to shared responsibility in the cloud: as you move to the cloud some responsibilities transfer to Microsoft, but for all cloud deployment types you own your data and identities. An identity, in this sense, is a user account and the sign-in that goes with it.
A cloud subscription is not a security service: the provider secures its side, and your side is still a management job.
Who looks after what in SaaS, PaaS and IaaS
Microsoft describes three service models, and the split moves with each one:
- SaaS (software as a service): ready-made applications you sign in to, such as Microsoft 365, Google Workspace, Xero or a hosted booking system.
- PaaS (platform as a service): you deploy your own applications without managing the virtual machines or operating systems underneath. A custom app on a managed hosting platform usually sits here.
- IaaS (infrastructure as a service): you rent virtual machines (servers that run as software on the provider's hardware) and manage the operating systems and applications on them yourself.
| Service model | The provider looks after | Your business looks after |
|---|---|---|
| SaaS | The infrastructure and the application itself | Your data, user accounts, sign-in settings, sharing settings and who has admin rights |
| PaaS | The infrastructure, the virtual machines and the operating systems | Everything in the SaaS row, plus the application you deploy and its configuration |
| IaaS | The physical infrastructure that runs the service | Everything in the PaaS row, plus the operating systems, their updates and security patches, and firewall settings |
| Every model | Its own part of the stack, as its terms describe | Data classification, data protection, encryption decisions and compliance with your data rules |
A website is a useful everyday example. business.gov.au says that with a cloud-based content management system the provider should keep your website safe from cyber attacks, while with a self-hosted website you need to keep the content management system and other tools up to date by applying the latest security patches yourself.
What Microsoft, AWS and Google each say
Microsoft
Microsoft lists the responsibilities you always retain, whatever the deployment type. Data is at the top: you are responsible for your data, including how it is classified, how it is protected, decisions about encryption, and compliance with data governance requirements. Identities, on-premises resources (anything still in your office) and the cloud components you control are also yours.
AWS
AWS describes security and compliance as a shared responsibility in its shared responsibility model. AWS protects the infrastructure that runs all of its services, and the customer's share depends on the services the customer selects. Where you run your own servers, AWS says the customer takes on the guest operating system, including updates and security patches, the application software on it, and the configuration of the firewall AWS provides, which it calls a security group.
Google Cloud
Google Cloud uses the same model to describe the tasks you have for security in the cloud, and adds its own idea, which it calls shared fate. In Google's description that includes building and operating a trusted cloud platform and giving customers guidance on how to configure it securely.
The jobs that stay with you in every model
Accounts and sign-in
Most cloud break-ins start with a stolen password, not with the provider's data centre. Multi-factor authentication (MFA) means proving who you are in two or more ways before you can log in, for example your password plus a code from an app. Turning it on for every account is your job, not the provider's. Australia's Essential Eight, at Maturity Level One, also asks that people who need admin rights use a separate admin account kept only for admin work, and that requests for that access are checked when first made. Our guide to Essential Eight Maturity Level One explains the rest of that level.
Sharing and settings
A folder shared with "anyone with the link", a former staff member who still has access, a storage area left open to the internet: these are customer settings. The provider runs the service exactly as you configured it.
Your data, including what gets deleted
Cloud services keep deleted items for a limited time, and after that they are gone. The windows are short and differ between services:
| What was deleted | How long an administrator can restore it |
|---|---|
| A Microsoft 365 user account | Within 30 days of deletion, with all associated data |
| A SharePoint site in Microsoft 365 | Kept for 93 days, then permanently deleted with its content and settings |
| A Google Workspace user account | Up to 20 days after deletion; after that the data cannot be restored |
| Google Drive items after a user empties their trash | Within 25 days |
If a mistake or a departing employee's account deletion is only noticed after those windows close, there is nothing for the provider to bring back. That is why a separate backup of the data you cannot afford to lose stays on your side of the line; our guide to the 3-2-1 backup rule for small business shows how to set one up.
Personal information and the law
If your business is covered by the Privacy Act, Australian Privacy Principle 11 requires you to take reasonable steps to protect the personal information you hold from misuse, interference and loss, and from unauthorised access. Using a cloud service does not move that duty to the provider. The OAIC says most small businesses, those with an annual turnover of $3 million or less, are not covered by the Act, though some are, and it recommends protecting personal information anyway as a matter of good practice. If you are unsure whether you are covered, check with the OAIC or a lawyer.
Where your data lives and what it costs
Choosing the region is a setting too. AWS lists two Regions in Australia: Sydney (ap-southeast-2), which needs no opt-in, and Melbourne (ap-southeast-4), which does. Google Cloud lists australia-southeast1 in Sydney and australia-southeast2 in Melbourne. The bill is also yours to watch: Google Cloud says an alerts-only budget does not cap spending, it only shows how costs are trending, and AWS Budgets can alert you on actual and forecast spend.
A checklist for your business
- List every cloud service the business pays for or signs in to, and write next to each whether it is SaaS, PaaS or IaaS.
- For each one, name the person or provider responsible for your side: accounts, settings, updates where they apply, and backups.
- Turn on MFA for every user, and give admin rights only to people who need them, through a separate admin account.
- Review who has access each quarter and remove former staff, contractors and old shared links.
- Check the restore windows above against how quickly you would notice a deletion, and set up a separate backup for anything you cannot lose.
- On any servers you rent, confirm who applies operating system patches and how quickly.
- Set budget alerts on infrastructure accounts, and check which region holds your data.
If nobody in the business owns this list, that is the gap to close first. Our managed IT support service can take on the day-to-day side, and our cyber security services can review your settings against the model.
Common mistakes
- Treating the subscription as the backup. The restore windows are measured in days, and only an administrator can use them.
- Assuming the provider patches everything. On rented servers, AWS says the guest operating system and its patches are the customer's job.
- Leaving MFA optional. One staff member without it can be the way in to the whole tenancy.
- Sharing one admin login. A shared admin account cannot be traced to a person and is hard to remove when someone leaves.
- Watching the bill only when it arrives. A budget alert warns you; it does not stop the spending.
Frequently asked questions
Who is responsible for cloud security, the provider or my business?
Both. The provider is responsible for the infrastructure it runs and, in software services, the application itself. Your business stays responsible for its data, its user accounts and the settings it controls, in every service model.
Does Microsoft 365 back up my business data?
Microsoft 365 keeps deleted items for limited periods: a deleted user account can be restored within 30 days and a deleted SharePoint site is kept for 93 days. After that the data is permanently deleted, so a separate backup is still worth having for anything you cannot afford to lose.
What is the difference between SaaS, PaaS and IaaS responsibilities?
With SaaS you use ready-made software and manage your data, accounts and settings. With PaaS you also manage the applications you deploy. With IaaS you also manage the operating systems on rented servers, including their updates and security patches.
Does the Privacy Act still apply if my data is in the cloud?
Yes, if your business is covered. Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, loss and unauthorised access, wherever it is stored. Check with the OAIC or a lawyer if you are unsure whether the Act covers you.
Is Google's shared fate model different from shared responsibility?
Google Cloud still uses the shared responsibility model to describe your security tasks. Shared fate is its description of its own approach, which includes running a trusted platform and providing guidance; your configuration choices remain yours.
Key takeaways
- The provider secures its infrastructure; your data, accounts and settings stay your job in every model.
- The more of the stack you rent, from SaaS to IaaS, the more of it you manage yourself.
- Deleted items can only be restored for a limited number of days, so keep a separate backup.
- Turn on MFA, separate admin accounts and review access regularly.
- Want a second opinion on your side of the line? Book a free first consultation; you receive a written quote before any work starts.