An auditor building a cloud risk register asks who is responsible for physical security of the data centers, such as badge access, guards and environmental controls, for workloads in IaaS, PaaS and SaaS. What is the correct answer?
Select an answer to reveal the explanation.
Short Explanation
Here's an easy anchor for you: customers never walk into the provider's data center to guard it. Physical security is always the provider's, whether it's IaaS, PaaS or SaaS. What shifts between models is everything from the operating system up.
Full Explanation
Every common shared responsibility model places physical facilities, hardware, power, cooling and on-site access control with the cloud provider, regardless of service model. Customers have no physical access to provider data centers and could not exercise these controls even if contracts assigned them. What changes between IaaS, PaaS and SaaS is the logical stack: in IaaS the customer manages the operating system upward, in PaaS the customer manages applications and configuration, and in SaaS the customer manages mainly data, identities and access settings. Assigning physical security to the customer in IaaS confuses control of virtual machines with control of the building; IaaS customers manage guest software, not facilities. Making the customer responsible in every model because it owns the data confuses data ownership with facility protection; data ownership drives classification, access and backup decisions, not guarding the site. Calling physical security shared in IaaS is also incorrect, because the customer contributes nothing to badge control or environmental protection. Exam caveat: the customer still has a duty to verify the provider's controls, typically through independent audit reports and certifications, which is an assurance responsibility, not a physical one. Operational check: obtain the provider's current third-party audit reports, confirm they cover the regions in use, and record the reliance in the risk register.