Cloud Shared Responsibility Model Explained (AWS, Azure, GCP, OCI)

Typical Split

• Provider — physical facilities, hypervisor, managed control planes (varies by service)
• Customer — identity, data classification, application security, logging configuration, key custody (often)
• Shared — configuration baselines, incident coordination, network controls depending on service model

AWS, Azure, GCP, OCI

All four publish shared-responsibility guidance. Differences show up most in identity defaults, key management options, and which logs are on by default — verify per service before CAIQ answers.

How CyberSilo Helps

• Map CCM controls in CyberSilo CSA (Compliance Standards Automation)
• Monitoring evidence with ThreatHawk SIEM
• Advisory for STAR readiness — contact CyberSilo

Frequently Asked Questions

Does shared responsibility remove CCM duties?

No. It clarifies which CCM controls you implement vs inherit from the CSP.

Is SaaS always the provider’s problem?

No. Customers still own account hygiene, data classification, and often identity federation.

How does SIEM fit?

Customers typically own enabling and monitoring logs even when the CSP generates them.

Related CSA CCM / STAR Resources

Hub · GCC cloud regs · CyberSilo CSA