Key takeaway
Define responsibility for each service, control identities and data, establish visibility, and practise recovery from incidents.
What cloud security covers
Cloud security covers accounts, identities, networks, applications, data and workloads. A provider may operate the infrastructure and parts of a service, while data classification, user and workload permissions, configuration choices and application security often remain the customer’s responsibility. The division changes across IaaS, PaaS, SaaS and individual services. Start by identifying the services and data in use, then document the actual responsibility matrix.
Protect identities, data and connections
Use centralized identity and appropriate MFA for people; create separate identities for services and applications and keep permissions to the minimum required. Classify data by sensitivity, then review encryption at rest and in transit, key management and backup protection. Allow only required network ingress and egress. Assign owners to APIs and third-party integrations, and keep credentials out of source code and public repositories.
Establish visibility and governance
Maintain an asset inventory, configuration baseline and change history. Plan log collection and retention, and turn identity events, API calls, resource changes and workload signals into actionable alerts. The six NIST CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond and Recover—can help structure a program. Do not present a framework as a compliance certificate; determine legal obligations separately from data location, processing and the organization’s role.
| Control objective | Example evidence | Responsible follow-up |
|---|---|---|
| Limit privileged access | Role and MFA review | Identity owner |
| Protect sensitive data | Access, encryption and key configuration | Data and service owner |
| Investigate changes | Usable audit event | Operations analyst and escalation |
| Recover service | Restore exercise result | Application and recovery owner |
Prepare for incidents and outages
Decide in advance which team will restrict an account, preserve logs, contact the provider and notify the business owner during a cloud incident. Practise revoking affected keys and sessions, isolating a resource and preserving evidence. Distinguish backups, availability in another zone and provider continuity capabilities from your own recovery plan. Set recovery-time and data-loss objectives around business needs and validate them in exercises.
Fit controls to data and team context
The same configuration may not fit every data class and service. Consider data sensitivity, who uses it, the provider’s region and processing terms; define an approval path among application, data and account owners. For regulated or contract-restricted data, confirm specific obligations with legal and privacy owners. Security controls support that decision; they do not make a legal compliance determination by themselves.