{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/shared-responsibility-model","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/shared-responsibility-model/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/shared-responsibility-model/"},"term":{"en":"Shared responsibility model","da":"Model for delt ansvar"},"aka":{"en":[],"da":["delt ansvar"]},"domain":["platform","security"],"cluster":"cloud","layer":"governance","status":"current","summary":{"en":"The split of security duties between a cloud provider and its customer, which shifts with the kind of service bought.","da":"Fordelingen af sikkerhedsopgaver mellem en cloududbyder og kunden, som flytter sig alt efter, hvilken slags tjeneste man køber."},"body":{"formal":{"en":"A division of security and operating duties in which the provider is responsible for the security of the cloud itself - buildings, hardware and the layers it runs - and the customer for what it puts in and sets up, with the line moving between IaaS, PaaS and SaaS.","da":"En fordeling af sikkerheds- og driftsopgaver, hvor udbyderen har ansvaret for sikkerheden i selve skyen - bygninger, hardware og de lag, den driver - og kunden for det, den lægger ind og sætter op, med en grænse, der flytter sig mellem IaaS, PaaS og SaaS."},"plain":{"en":"Like renting a flat - the landlord must keep the front door lock and the wiring safe, but locking your own door and not handing out spare keys is up to you.","da":"Som at leje en lejlighed - udlejeren skal holde gadedørens lås og ledningerne i væggene i orden, men at låse din egen dør og ikke dele ekstranøgler ud er op til dig."},"inPractice":{"en":"During a supplier review, the compliance officer at a hospital region maps each ISO 27001 control to provider, customer or both, and finds that nobody had taken charge of backing up the region's SaaS data.","da":"Ved en leverandørgennemgang fordeler den compliance-ansvarlige i en region hver ISO 27001-kontrol på udbyder, kunde eller begge og opdager, at ingen havde taget ansvar for backup af regionens SaaS-data."},"whyItMatters":{"en":"Many cloud incidents happen in the gap where each side assumed the other was responsible; writing the split down is what closes it.","da":"Mange cloudhændelser sker i hullet, hvor hver part troede, at den anden havde ansvaret; det er ved at skrive fordelingen ned, at hullet lukkes."}},"deepDive":{"en":"There is no single normative version of the model; each provider publishes its own matrix, AWS as \"security of the cloud\" versus \"security in the cloud\", Microsoft as a responsibility chart by service type, and Google under the label \"shared fate\", which stresses secure defaults and blueprints on the provider's side. The formal anchors lie elsewhere. The CSA Cloud Controls Matrix (version 4, 197 control objectives in 17 domains) comes with implementation guidance that assigns each control to the cloud service provider, the cloud service customer or both. ISO/IEC 27017:2015 gives cloud-specific implementation guidance written separately for provider and customer, and ISO/IEC 27001:2022 Annex A 5.23 (information security for use of cloud services) requires processes for acquiring, using, managing and exiting cloud services.\n\nThe split is set per service and per feature, not only per service model. In managed Kubernetes the provider runs the control plane (API server, etcd), while node OS patching may stay with the customer depending on the node mode, and workloads, RBAC and network policies always do. In a managed database the provider patches the engine inside maintenance windows, while the customer owns database accounts, network exposure, backup retention settings and key choice. Customer-managed encryption keys move key lifecycle and availability risk to the customer: disabling or deleting the key makes the data unrecoverable by design.\n\nIn audits the customer relies on the provider's controls through its SOC 2 Type II or ISAE 3402 reports. These reports list complementary user entity controls, which the customer must operate for the provider's controls to be effective, and they state whether subservice organisations are carved out or included. Unread complementary controls and carved-out subservice providers are a common blind spot in supplier reviews. US federal authorisations use an equivalent customer responsibility matrix.\n\nAllocating tasks does not allocate accountability. Under GDPR the controller remains accountable (Art. 5(2) and Art. 24), while Art. 28(3)(c) obliges the processor to take the Art. 32 security measures; NIS2 Art. 21(2)(d) covers supply chain security; and for the financial sector DORA (Regulation (EU) 2022/2554) Arts. 28 to 30 set out ICT third-party risk management and mandatory contract terms. A known limitation is that the model divides duties but says little about provider-side compromises that customers cannot prevent, such as the 2023 theft of a Microsoft signing key in the Storm-0558 incident; customers still need detection, logging and exit plans for that residual risk.","da":"Der findes ingen enkelt normativ udgave af modellen; hver udbyder offentliggør sin egen matrix, AWS som \"security of the cloud\" over for \"security in the cloud\", Microsoft som et ansvarsskema pr. servicetype og Google under betegnelsen \"shared fate\", der fremhæver sikre standardindstillinger og skabeloner fra udbyderens side. De formelle ankre ligger andre steder. CSA Cloud Controls Matrix (version 4, 197 kontrolmål i 17 domæner) har implementeringsvejledning, der placerer hver kontrol hos cloududbyderen, cloudkunden eller begge. ISO/IEC 27017:2015 giver cloudspecifik vejledning skrevet separat for udbyder og kunde, og ISO/IEC 27001:2022 bilag A 5.23 (informationssikkerhed ved brug af cloudtjenester) kræver processer for anskaffelse, brug, styring og exit af cloudtjenester.\n\nFordelingen fastlægges pr. tjeneste og pr. funktion, ikke kun pr. servicemodel. I managed Kubernetes driver udbyderen kontrolplanet (API-server, etcd), mens patching af nodernes styresystem afhængigt af nodetypen kan blive hos kunden, og workloads, RBAC og netværkspolitikker altid gør. I en managed database patcher udbyderen databasemotoren inden for vedligeholdelsesvinduer, mens kunden ejer databasekonti, netværkseksponering, indstillinger for opbevaring af backup og valg af nøgler. Kundestyrede krypteringsnøgler flytter nøglens livscyklus og tilgængelighedsrisiko over til kunden: deaktiveres eller slettes nøglen, kan data med vilje ikke længere genskabes.\n\nVed revision læner kunden sig op ad udbyderens kontroller gennem SOC 2 Type II- eller ISAE 3402-erklæringer. Erklæringerne opregner komplementære kontroller hos brugervirksomheden, som kunden selv skal udføre, for at udbyderens kontroller er effektive, og de angiver, om underleverandører er udeladt (carve-out) eller medtaget. Ulæste komplementære kontroller og udeladte underleverandører er en almindelig blind vinkel i leverandørgennemgange. Amerikanske føderale godkendelser bruger en tilsvarende customer responsibility matrix.\n\nAt fordele opgaver er ikke det samme som at fordele ansvaret. Efter databeskyttelsesforordningen forbliver den dataansvarlige ansvarlig (art. 5, stk. 2, og art. 24), mens art. 28, stk. 3, litra c, forpligter databehandleren til at træffe sikkerhedsforanstaltningerne efter art. 32; NIS2-direktivets art. 21, stk. 2, litra d, dækker sikkerhed i forsyningskæden; og for finanssektoren fastlægger DORA (forordning (EU) 2022/2554) art. 28-30 styring af IKT-tredjepartsrisici og obligatoriske kontraktvilkår. En kendt begrænsning er, at modellen fordeler opgaver, men siger lidt om kompromitteringer hos udbyderen, som kunden ikke kan forhindre, fx tyveriet af en Microsoft-signeringsnøgle i Storm-0558-hændelsen i 2023; kunden har stadig brug for detektion, logning og exitplaner til den restrisiko."},"edges":[{"type":"requires","to":"platform/cloud-computing","confidence":"high","strength":"normal"},{"type":"mitigates","to":"platform/cloud-misconfiguration","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","why":{"en":"Supplier management is where the split of duties is checked, written into contracts and followed up.","da":"Leverandørstyring er dér, hvor fordelingen af opgaver bliver kontrolleret, skrevet ind i kontrakter og fulgt op."},"confidence":"high","strength":"primary"}],"depth":6,"sources":[{"title":"NIST SP 800-145 - The NIST Definition of Cloud Computing","tier":"standard","publisher":"NIST"},{"title":"CSA Cloud Controls Matrix (CCM)","tier":"reference","publisher":"Cloud Security Alliance"}],"draft":true}