~/moritzsamrock_

Shared Responsibility Model

Also known as:SRM

Shared Responsibility Model: Division of security tasks between the cloud provider and the customer. Effectiveness is achieved through clear responsibilitiesResponsibilityAn explicitly assigned obligation to make, perform, or verify a security decision or task., documented specifications, regular reviews, and measurable improvement goals.

How it works and where it fits

Shared Responsibility Model creates a traceable framework for security decisions. Scope, assumptions, evaluation criteria, responsibilities, and expected outcomes are made explicit. It is therefore more than documentation: it connects business objectives and protection needs to concrete controls, accepted residual risks, and verifiable evidence.

Practical security relevance

Effectiveness requires an accountable owner, periodic review, and measurable criteria. Decisions should use current data, while exceptions record rationale, duration, and compensating measures. Audits and metrics should test not only whether a requirement formally exists, but whether it is applied in daily work and actually reduces the intended risk.

  • Cloud Security Posture ManagementCloud Security Posture ManagementDetects misconfigurations and compliance deviations in cloud environments.: Detects misconfigurations and compliance deviations in cloud environments.
  • Cloud-Native Application Protection PlatformCloud-Native Application Protection PlatformIntegrated platform for securing cloud applications across development and operations.: Integrated platform for securing cloud applications across development and operations.
  • Infrastructure as Code SecurityInfrastructure as Code SecurityExamination of declarative infrastructure definitions for misconfigurations and risks.: Examination of declarative infrastructure definitions for misconfigurations and risks.
  • Cloud Access Security BrokerCloud Access Security BrokerControls and monitors the use of cloud services between users and providers.: Controls and monitors the use of cloud services between users and providers.

Related terms