A municipal hybrid estate runs voter-registration data in a cloud SaaS tenant and legacy case files in an on-premises data center. What should an enterprise security audit scope include?

Hybrid municipal estates place case-file confidentiality and integrity at risk in both the cloud control plane and the on-premises data center. A credible audit therefore examines identity and access settings, logging, encryption, network segmentation, and administrative paths in the cloud—where misconfigured roles, public buckets, or weak federation can expose records—and the physical and logical controls protecting servers, storage, and backup media that still hold sensitive justice or social-services data on site. Looking at only one side leaves a blind spot: attackers and auditors both follow the data and the keys that unlock it. Scope should follow asset inventory, data classification, and trust boundaries, including how identities bridge cloud and on-prem and how privileged sessions are monitored across both.

Limiting review to on-premises printers because “cloud providers never need review” ignores shared-responsibility gaps and customer-configurable cloud controls that cities still own. Social-media brand accounts managed by communications staff may warrant separate governance, but they are not a substitute for auditing systems that store case files. Focusing only on cafeteria point-of-sale because hybrid estates supposedly exclude identity systems misunderstands the architecture: identity is often the highest-leverage control plane in hybrid designs. Exam caveat: shared responsibility does not mean “no city responsibility”—configuration, identity, and data protection remain in scope. Operationally, produce a hybrid system diagram with control owners for cloud IAM, key management, and on-prem access, then sample evidence from both environments for the same classification tier of case data.