What your cloud provider secures, and what your business still owns

Cloud providers secure the facilities, physical infrastructure, and managed platform components included in the service. Customers still retain important responsibilities, and the exact boundary changes depending on whether they use infrastructure, platform, or software services.

AWS describes this as security “of” the cloud and security “in” the cloud. Azure and Google Cloud architecture guidance similarly emphasize customer decisions around identity, data, configuration, observability, reliability, performance, cost, and workload operations.

Responsibilities that remain with the organization

• —Classifying data and deciding where, why, and for how long it is processed.
• —Managing users, administrators, service accounts, roles, keys, secrets, and access reviews.
• —Configuring networks, storage, logs, encryption, backups, alerts, and workload-level protections.
• —Securing applications, dependencies, integrations, endpoints, and customer-controlled operating systems.
• —Defining service objectives, recovery plans, budgets, deployment controls, and operational ownership.

Establish foundations before migration

A cloud landing zone should establish account structure, identity, network boundaries, policy controls, logging, key management, cost allocation, backup, and deployment paths before production workloads multiply. Retrofitting these foundations later is slower and leaves inconsistent controls in place for longer.

The right migration plan names each responsibility, assigns an owner, records evidence, and tests failure and recovery scenarios. Cloud value depends as much on operational discipline as it does on platform capability.