A wastewater SCADA vendor claims that adopting Azure removes all customer security work. How should the city respond using shared responsibility?
Select an answer to reveal the explanation.
Short Explanation
Anybody promising "zero security work" is selling fairy dust. Cloud shifts some duties, but the city still owns identities, data, and plenty of configuration. Shared responsibility is a handoff map, not a blank check.
Full Explanation
Cloud adoption never means zero customer security responsibility. Shared responsibility is a handoff map across layers, not a vendor promise that municipal teams can stop protecting identities, data, and configurations. A wastewater SCADA vendor claiming Azure removes all customer security work should be rejected on fundamentals grounds, regardless of how much platform Microsoft manages for a given service.
Accepting that Azure automatically owns every SCADA password and network allow list hands critical operational controls to a myth. Treating shared responsibility as marketing-slide fiction rather than real workload guidance undercuts governance. Believing a subscription lets customers disable all identity controls is the opposite of secure cloud operations.
Exam caveat: OT/SCADA environments often add network segmentation and vendor-support constraints on top of the cloud model; those extras do not erase identity and configuration duties. Operational check: require the vendor to produce a responsibility matrix for the proposed architecture covering identity, patching, network rules, logging, and data protection—and reject any statement that lists “none” for the city. For SCADA-adjacent designs, also insist on documenting who manages jump hosts, firewall allow lists, vendor remote access, and log retention—areas vendors sometimes quietly leave to the city while advertising “fully managed cloud.”