{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"platform/shared-responsibility-model","url":{"en":"https://atlas.maintz.dev/en/terms/platform/shared-responsibility-model/","da":"https://atlas.maintz.dev/da/terms/platform/shared-responsibility-model/"},"term":{"en":"Shared responsibility model","da":"Model for delt ansvar"},"aka":{"en":[],"da":["delt ansvar"]},"domain":["platform","security"],"cluster":"cloud","layer":"governance","status":"current","summary":{"en":"The split of security duties between a cloud provider and its customer, which shifts with the kind of service bought.","da":"Fordelingen af sikkerhedsopgaver mellem en cloududbyder og kunden, som flytter sig alt efter, hvilken slags tjeneste man køber."},"body":{"formal":{"en":"A division of security and operating duties in which the provider is responsible for the security of the cloud itself - buildings, hardware and the layers it runs - and the customer for what it puts in and sets up, with the line moving between IaaS, PaaS and SaaS.","da":"En fordeling af sikkerheds- og driftsopgaver, hvor udbyderen har ansvaret for sikkerheden i selve skyen - bygninger, hardware og de lag, den driver - og kunden for det, den lægger ind og sætter op, med en grænse, der flytter sig mellem IaaS, PaaS og SaaS."},"plain":{"en":"Like renting a flat - the landlord must keep the front door lock and the wiring safe, but locking your own door and not handing out spare keys is up to you.","da":"Som at leje en lejlighed - udlejeren skal holde gadedørens lås og ledningerne i væggene i orden, men at låse din egen dør og ikke dele ekstranøgler ud er op til dig."},"inPractice":{"en":"During a supplier review, the compliance officer at a hospital region maps each ISO 27001 control to provider, customer or both, and finds that nobody had taken charge of backing up the region's SaaS data.","da":"Ved en leverandørgennemgang fordeler den compliance-ansvarlige i en region hver ISO 27001-kontrol på udbyder, kunde eller begge og opdager, at ingen havde taget ansvar for backup af regionens SaaS-data."},"whyItMatters":{"en":"Many cloud incidents happen in the gap where each side assumed the other was responsible; writing the split down is what closes it.","da":"Mange cloudhændelser sker i hullet, hvor hver part troede, at den anden havde ansvaret; det er ved at skrive fordelingen ned, at hullet lukkes."}},"deepDive":{"en":"There is no single normative version of the model; each provider publishes its own matrix, AWS as \"security of the cloud\" versus \"security in the cloud\", Microsoft as a responsibility chart by service type, and Google under the label \"shared fate\", which stresses secure defaults and blueprints on the provider's side. The formal anchors lie elsewhere. The CSA Cloud Controls Matrix (version 4, 197 control objectives in 17 domains) comes with implementation guidance that assigns each control to the cloud service provider, the cloud service customer or both. ISO/IEC 27017:2015 gives cloud-specific implementation guidance written separately for provider and customer, and ISO/IEC 27001:2022 Annex A 5.23 (information security for use of cloud services) requires processes for acquiring, using, managing and exiting cloud services.\n\nThe split is set per service and per feature, not only per service model. In managed Kubernetes the provider runs the control plane (API server, etcd), while node OS patching may stay with the customer depending on the node mode, and workloads, RBAC and network policies always do. In a managed database the provider patches the engine inside maintenance windows, while the customer owns database accounts, network exposure, backup retention settings and key choice. Customer-managed encryption keys move key lifecycle and availability risk to the customer: disabling or deleting the key makes the data unrecoverable by design.\n\nIn audits the customer relies on the provider's controls through its SOC 2 Type II or ISAE 3402 reports. These reports list complementary user entity controls, which the customer must operate for the provider's controls to be effective, and they state whether subservice organisations are carved out or included. Unread complementary controls and carved-out subservice providers are a common blind spot in supplier reviews. US federal authorisations use an equivalent customer responsibility matrix.\n\nAllocating tasks does not allocate accountability. Under GDPR the controller remains accountable (Art. 5(2) and Art. 24), while Art. 28(3)(c) obliges the processor to take the Art. 32 security measures; NIS2 Art. 21(2)(d) covers supply chain security; and for the financial sector DORA (Regulation (EU) 2022/2554) Arts. 28 to 30 set out ICT third-party risk management and mandatory contract terms. A known limitation is that the model divides duties but says little about provider-side compromises that customers cannot prevent, such as the 2023 theft of a Microsoft signing key in the Storm-0558 incident; customers still need detection, logging and exit plans for that residual risk.","da":"Der findes ingen enkelt normativ udgave af modellen; hver udbyder offentliggør sin egen matrix, AWS som \"security of the cloud\" over for \"security in the cloud\", Microsoft som et ansvarsskema pr. servicetype og Google under betegnelsen \"shared fate\", der fremhæver sikre standardindstillinger og skabeloner fra udbyderens side. De formelle ankre ligger andre steder. CSA Cloud Controls Matrix (version 4, 197 kontrolmål i 17 domæner) har implementeringsvejledning, der placerer hver kontrol hos cloududbyderen, cloudkunden eller begge. ISO/IEC 27017:2015 giver cloudspecifik vejledning skrevet separat for udbyder og kunde, og ISO/IEC 27001:2022 bilag A 5.23 (informationssikkerhed ved brug af cloudtjenester) kræver processer for anskaffelse, brug, styring og exit af cloudtjenester.\n\nFordelingen fastlægges pr. tjeneste og pr. funktion, ikke kun pr. servicemodel. I managed Kubernetes driver udbyderen kontrolplanet (API-server, etcd), mens patching af nodernes styresystem afhængigt af nodetypen kan blive hos kunden, og workloads, RBAC og netværkspolitikker altid gør. I en managed database patcher udbyderen databasemotoren inden for vedligeholdelsesvinduer, mens kunden ejer databasekonti, netværkseksponering, indstillinger for opbevaring af backup og valg af nøgler. Kundestyrede krypteringsnøgler flytter nøglens livscyklus og tilgængelighedsrisiko over til kunden: deaktiveres eller slettes nøglen, kan data med vilje ikke længere genskabes.\n\nVed revision læner kunden sig op ad udbyderens kontroller gennem SOC 2 Type II- eller ISAE 3402-erklæringer. Erklæringerne opregner komplementære kontroller hos brugervirksomheden, som kunden selv skal udføre, for at udbyderens kontroller er effektive, og de angiver, om underleverandører er udeladt (carve-out) eller medtaget. Ulæste komplementære kontroller og udeladte underleverandører er en almindelig blind vinkel i leverandørgennemgange. Amerikanske føderale godkendelser bruger en tilsvarende customer responsibility matrix.\n\nAt fordele opgaver er ikke det samme som at fordele ansvaret. Efter databeskyttelsesforordningen forbliver den dataansvarlige ansvarlig (art. 5, stk. 2, og art. 24), mens art. 28, stk. 3, litra c, forpligter databehandleren til at træffe sikkerhedsforanstaltningerne efter art. 32; NIS2-direktivets art. 21, stk. 2, litra d, dækker sikkerhed i forsyningskæden; og for finanssektoren fastlægger DORA (forordning (EU) 2022/2554) art. 28-30 styring af IKT-tredjepartsrisici og obligatoriske kontraktvilkår. En kendt begrænsning er, at modellen fordeler opgaver, men siger lidt om kompromitteringer hos udbyderen, som kunden ikke kan forhindre, fx tyveriet af en Microsoft-signeringsnøgle i Storm-0558-hændelsen i 2023; kunden har stadig brug for detektion, logning og exitplaner til den restrisiko."},"howTo":{"steps":{"en":["List every cloud service you use with its service model (IaaS, PaaS or SaaS) and the data it holds.","For each service, read the provider's responsibility documentation and record in a responsibility matrix which controls sit with the provider, with you or with both, for example using the CSA Cloud Controls Matrix.","Mark the areas that are always yours - data, identities and access, configuration, the devices that connect, and often backup of SaaS data.","Read the provider's SOC 2 Type II or ISAE 3402 report, list its complementary user entity controls, and note whether subservice organisations are carved out.","Give every customer-side control a named internal owner, and write the split into the contract and the data processing agreement.","Implement your side - secure configuration, MFA, logging, backup, and key management if you use customer-managed keys.","Plan for provider-side failures you cannot prevent, with detection, logging and a tested exit plan.","Review the matrix at least once a year and whenever you adopt a new service or feature, as part of supplier management."],"da":["List alle cloudtjenester, I bruger, med servicemodel (IaaS, PaaS eller SaaS) og de data, de rummer.","Læs for hver tjeneste udbyderens beskrivelse af ansvarsfordelingen, og registrér i en ansvarsmatrix, hvilke kontroller der ligger hos udbyderen, hos jer eller hos begge, fx med CSA Cloud Controls Matrix.","Markér de områder, der altid er jeres - data, identiteter og adgang, konfiguration, de enheder, der kobler på, og ofte backup af SaaS-data.","Læs udbyderens SOC 2 Type II- eller ISAE 3402-erklæring, list de komplementære kontroller hos brugervirksomheden, og notér, om underleverandører er udeladt (carve-out).","Giv hver kontrol på kundesiden en navngiven intern ejer, og skriv fordelingen ind i kontrakten og databehandleraftalen.","Implementér jeres del - sikker konfiguration, MFA, logning, backup og nøglehåndtering, hvis I bruger kundestyrede nøgler.","Planlæg for fejl hos udbyderen, som I ikke kan forhindre, med detektion, logning og en afprøvet exitplan.","Gennemgå matrixen mindst én gang om året, og når I tager en ny tjeneste eller funktion i brug, som en del af leverandørstyringen."]},"pitfalls":{"en":["Assuming the provider backs up your SaaS data or configures security for you.","Thinking that handing over tasks also hands over legal accountability, for example as data controller under GDPR.","Never reading the complementary user entity controls in the provider's audit report.","Using one generic matrix per service model and ignoring that the split differs per service and even per feature."],"da":["At gå ud fra, at udbyderen tager backup af jeres SaaS-data eller sætter sikkerheden op for jer.","At tro, at det juridiske ansvar følger med, når man overlader opgaver, fx som dataansvarlig efter databeskyttelsesforordningen.","Aldrig at læse de komplementære kontroller hos brugervirksomheden i udbyderens revisionserklæring.","At bruge én generel matrix pr. servicemodel og overse, at fordelingen er forskellig for hver tjeneste og endda hver funktion."]},"guides":[{"title":"Cloud security shared responsibility model","url":"https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model","publisher":"NCSC UK","tier":"official-doc"},{"title":"Shared responsibility in the cloud - Microsoft Azure","url":"https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility","publisher":"Microsoft","tier":"official-doc"},{"title":"Shared Responsibility Model - Amazon Web Services","url":"https://aws.amazon.com/compliance/shared-responsibility-model/","publisher":"AWS","tier":"official-doc"},{"title":"Vejledning i anvendelse af cloudservices","url":"https://sikkerdigital.dk/media/7011/vejledning-i-anvendelse-af-cloudservices-v11-juli-2020.pdf","publisher":"Digitaliseringsstyrelsen","tier":"official-doc","lang":"da"},{"title":"Vejledning om cloud","url":"https://www.datatilsynet.dk/regler-og-vejledning/cloud","publisher":"Datatilsynet","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"platform/cloud-computing","confidence":"high","strength":"normal"},{"type":"mitigates","to":"platform/cloud-misconfiguration","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","why":{"en":"Supplier management is where the split of duties is checked, written into contracts and followed up.","da":"Leverandørstyring er dér, hvor fordelingen af opgaver bliver kontrolleret, skrevet ind i kontrakter og fulgt op."},"confidence":"high","strength":"primary"}],"depth":6,"sources":[{"title":"NIST SP 800-145 - The NIST Definition of Cloud Computing","tier":"standard","publisher":"NIST"},{"title":"CSA Cloud Controls Matrix (CCM)","tier":"reference","publisher":"Cloud Security Alliance"}],"draft":true}