Shared responsibility model
A shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job. Cyber Essentials v3.3 accepts that a provider may implement some controls for you, but you stay responsible for all of them and need the provider's commitment in a contract or a document the contract references.
- Term
- Shared responsibility model
- Also known as
- Shared responsibility
- Category
- Malware, cloud and threats
- Requirement area
- D(iv) Cloud services
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term shared responsibility model mean in Cyber Essentials?
A shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.
Cloud providers will often explain how they implement security in documents published in their trust centres, referencing a ‘shared responsibility model.’
How does shared responsibility model apply to Cyber Essentials?
In plain terms
Think of a car hire firm. It services the engine, keeps the tyres legal and insures the vehicle. You still lock the doors, keep the keys safe and drive carefully. A cloud provider's shared responsibility model is that split, written down. Large providers such as Microsoft and Amazon publish theirs in their trust centres.
What Cyber Essentials asks
The requirements start from a firm rule: "the applicant organisation is always responsible for ensuring all controls are implemented, but some of the controls can be implemented by the cloud service provider." Who does what depends on whether the service is IaaS, PaaS or SaaS, and Table 1 of the requirements sets out the typical split.
Where the provider implements a control for you, "you must make sure that the cloud provider has committed to implementing this via contractual clauses or documents referenced by contract, such as security statements or privacy statements." A published shared responsibility model is often where that commitment is written down.
User access control sits with your organisation for every type of cloud service. No provider document takes MFA or account management off your list, which is why A7.16 and A7.17 are yours to answer.
What an assessor looks for
- Every cloud service listed at A2.9, whoever implements the controls.
- A provider document you can point to for any control you say the provider implements.
See cloud services scope. Related: cloud service, managed service provider.
Related terms
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
Frequently asked questions
A shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
Shared responsibility model relates to D(iv) Cloud services in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.