A pharmaceutical company is evaluating a third-party GenAI platform, built on a cloud provider's managed AI services, to process clinical trial data. The company's security lead wants to clarify who is responsible for which security controls. Which framework should guide this conversation?
Select an answer to reveal the explanation.
Short Explanation
Think of it like this: renting an apartment, the landlord secures the building, but you still lock your own door. That's the shared responsibility model — the cloud provider secures the underlying AI infrastructure, while your company stays on the hook for its own data and who gets to touch it.
Full Explanation
The shared responsibility model is the standard framework for exactly this conversation: it clarifies that the cloud provider secures the underlying infrastructure and managed service, while the company remains responsible for its own data, who has access to it, and how it's used. Assuming the provider is fully responsible for all security ignores the company's own obligations for its data and access configuration — a common but risky misunderstanding of managed services. Assuming the company is fully responsible for everything, including the provider's physical data center security, overstates the company's role and misunderstands what a managed cloud AI service actually delivers. Deciding responsibility case by case without a documented framework leaves gaps and inconsistency, since nothing guarantees every security area gets assigned an owner. The general principle: a shared responsibility model gives a clear, consistent division of security duties between provider and customer, replacing guesswork or all-or-nothing assumptions.