Cloud policies: security, governance and business needs
Shared responsibility and the security policy set
25 min
Cloud security policy starts from the shared responsibility model. The provider secures the cloud (facilities, hardware, hypervisor, managed-service internals); the customer secures what it puts in the cloud. The split moves with the service model, and every policy names the customer's side of the line.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Data, classification, access decisions | Customer | Customer | Customer |
| Identities and accounts | Customer | Customer | Customer |
| Application | Customer | Customer | Provider |
| Runtime, middleware, OS patching | Customer | Provider | Provider |
| Network controls (security groups, firewalls) | Customer | Shared | Provider |
| Hypervisor, hardware, facility | Provider | Provider | Provider |
- Identity and access: SSO through the corporate IdP, MFA for every human, no long-lived keys, least privilege, break-glass accounts logged and alarmed.
- Data protection: classification levels, encryption at rest and in transit, customer-managed keys (KMS, Key Vault, Cloud KMS) for restricted data.
- Logging and monitoring: organization-wide audit trail (CloudTrail, Azure Activity Log, Cloud Audit Logs) to a separate, write-protected log account.
- Network: private endpoints for PaaS, no public storage buckets, egress through inspected paths.
- Vulnerability and configuration: CSPM findings triaged on an SLA, CIS Benchmarks as the baseline.
- Third-party and SaaS: security review before purchase, SOC 2 Type II or ISO/IEC 27001 evidence, right to audit.
Misconfiguration on the customer side is the common cloud breach pattern: a public bucket, an over-privileged role, an exposed key. A policy that relies on people remembering is weak; pair each rule with a preventive or detective control.
Word bank
All definitions →- CSPM
- Cloud security posture management: tooling that checks cloud configuration against policy and benchmarks.
- Customer-managed key (CMK)
- An encryption key the customer creates, rotates and can revoke in the provider's key service.
- Shared responsibility model
- The split of security duties between cloud provider and customer, which shifts with IaaS, PaaS and SaaS.
Knowledge check
In a SaaS CRM, which duty stays with the customer?
Which pairing turns a cloud policy rule into an enforced control?