What is the Shared Responsibility Model in Cloud Computing?

Updated on: October 30, 2026

Author: Ioana Grigorescu, Content Manager

Reviewed by: George Ploaie, Chief Operating Officer (COO)

Learn about cloud security's shared responsibility model. See who's responsible for what, across SaaS, PaaS, and IaaS, so you can keep your cloud data safe.

What is the shared responsibility model in cloud computing?

The shared responsibility model in cloud computing is a framework that divides security duties between the cloud service provider and the client. In essence, it clarifies who is responsible for each aspect of security to ensure effective protection of the cloud environment.

CISA’s Binding Operational Directive 25-01, issued on 17 December 2024, requires US federal civilian agencies to apply secure configuration baselines to certain SaaS products – which is essentially the customer’s end of the equation.

The specifics of this division are a little different depending on the service model (SaaS, PaaS, IaaS).

How do responsibilities differ between SaaS, PaaS, and IaaS cloud models?

The differences between the three models include:

SaaS (Software-as-a-Service): The provider handles the underlying infrastructure and the application, while the customer stays responsible for its data and access policies, including user access and data classification.
PaaS (Platform-as-a-Service): The provider is responsible for the supporting system, including Web services, operating systems, etc., while the customer is responsible for all applications and data.
IaaS (Infrastructure-as-a-Service): The provider controls the physical layer while the customer controls applications, operating systems, and data.


Cloud Model	Provider Responsibilities	Customer Responsibilities
Service Model Breakdown
SaaS	– Underlying infrastructure – Application maintenance – Encryption and backups – Physical security – Network security	– User access management – Data classification – Device security – Security awareness training – Incident response planning
PaaS	– Supporting system – Web services – Operating system – Network infrastructure	– All applications – Application data – Access controls – Security configurations
IaaS	– Physical layer – Hardware – Basic network infrastructure	– Operating systems – Applications – Data management – Network and firewall configurations – Access management

What specific security aspects are the responsibility of the SaaS provider?

The SaaS provider is responsible for five security aspects of the service it runs:

Physical security: Protect data centers and hardware.
Network security: Protection against the threats posed by unauthorized access or cyber-attacks.
Application security: Updating software to fix security weaknesses or bugs to prevent breaches.
Data security: Encrypting data both when it’s stored and during transmission, and making sure there are backups or disaster recovery.
Operational security: Detecting threats and responding to security incidents.

What specific security aspects are the responsibility of the SaaS customer?

The SaaS customer’s security responsibility covers the aspects below. In Google Cloud’s description of the model, customers always remain responsible for their access policies and data (Google Cloud).

Device security: Protecting the device that is being used to access the SaaS application.
Access management: Managing the right limitations of the users and their ability to access an application, the procedures to verify their identity, and the authorization to access the application.
Security awareness training: Training of the employees on security measures and phishing risks.
Data classification: Identifying sensitive data and putting measures in place to protect it.
Incident response: Having a contingency plan for how security threats could be handled.
Secure configuration: Configuring the security settings that the application provides; CISA’s BOD 25-01 mandates that US federal civilian agencies comply with the baselines for specific SaaS products (CISA).

How can organizations effectively communicate and collaborate with their SaaS providers to ensure a robust shared security posture?

Organizations and Software as a Service providers and suppliers should:

Regularly review the SaaS provider’s security documentation and certifications: Learn about their security practices and make sure that they meet your organization’s standards.
Ensure proper communication: Maintain clear communication channels for discussing the issue of security, reporting any problems, and being aware of any security updates from the SaaS vendor.
Join the security awareness programs: Ensure your staff joins security awareness programs that are offered by the SaaS provider.
Conduct joint security assessments: Collaborate to identify and reduce risks in the shared environment.
Service Level Agreement (SLA): Establish the security requirements and responsibilities through a written contractual agreement.

Conclusion

Understanding the shared responsibility model will help organizations mitigate risks related to security in SaaS solutions. Remember, the customer and the SaaS provider must work together in order to achieve adequate security and must remain vigilant at all times.