# Cloud shared responsibility worksheet

Use this for each cloud service an organization uses, to write down who is responsible for what. The split
changes with the service model. Whatever the model, the customer stays responsible for its data, for how
that data is classified, and for who can access it. It follows the cloud concepts taught for ISC2's CCSP
exam (outline effective 1 August 2026); your contract and the provider's documentation decide the detail.

## The service

- [ ] Service name and provider: ____________
- [ ] Service model: IaaS, PaaS or SaaS
- [ ] Deployment model: public, private, community or hybrid
- [ ] Regions where data is stored and processed: ____________

## Always the customer, in every model

- [ ] Data classification for everything stored in the service
- [ ] Identity and access management policies: who can access what
- [ ] What data is put into the service at all

## IaaS: the customer also owns

- [ ] Guest operating system, patched and hardened
- [ ] Middleware and runtime environment
- [ ] Application code
- [ ] Network configuration inside the customer's environment

## PaaS: the customer also owns

- [ ] Application code deployed to the platform
- [ ] Platform configuration choices the provider exposes

## SaaS: the customer also owns

- [ ] Configuration of the application's security and sharing settings
- [ ] User provisioning and deprovisioning

## The provider (check the contract)

- [ ] Physical data center security and the underlying infrastructure
- [ ] For PaaS, the operating system beneath the platform; for SaaS, the whole application stack
- [ ] Audit reports or certifications the provider will share, and how often
- [ ] Incident notification terms and timelines
- [ ] Data return and deletion at the end of the contract (for example by crypto-shredding)