What security responsibilities remain with our business under IaaS?
Under Infrastructure as a Service (IaaS), your provider secures the underlying infrastructure, while your business remains responsible for how it uses and configures that environment. This typically includes protecting user accounts, managing access permissions, securing applications and data, applying appropriate policies, and meeting your regulatory obligations.
Under IaaS, your business retains responsibility for deciding how the environment is governed, verifying that controls are working, and responding when they are not. The provider may operate the physical facilities, servers, storage and network hardware, but that does not transfer ownership of your risk, legal duties or business decisions.
The exact boundary depends on the service agreement. Some IaaS services leave more configuration and maintenance with the customer than others. Before migration, document which party is responsible for each control, including the operating system, virtual network, firewalls, storage, backup configuration, monitoring, patching and incident handling. Avoid relying on the phrase “secure infrastructure” without identifying the specific controls and evidence included.
Your business should normally retain responsibility for:
- Identity and privileged access: create individual accounts, enforce strong authentication, restrict administrator rights, review permissions and remove access when people change role or leave. Shared administrator accounts make investigation and accountability more difficult.
- Configuration: set networks, security groups, firewall rules, storage permissions and management interfaces so that systems are not unnecessarily exposed. Changes should follow an approval process and be recorded, particularly where they affect internet access or privileged services.
- Operating systems and workloads: establish who applies updates to guest operating systems, middleware and installed software. If your team manages these components, it must assess patches, test them appropriately and track exceptions where an update cannot be applied.
- Data protection: classify the information placed in the environment, define retention and deletion requirements, and ensure that data is stored and transferred in accordance with your contractual, regulatory and privacy obligations. Encryption may protect data, but responsibility for selecting settings and managing keys can remain with your organisation.
- Endpoints and connections: secure laptops, servers and other devices used to administer or access the IaaS environment. A well-configured hosted platform can still be compromised through a stolen credential, an infected endpoint or an unsafe remote connection.
- Monitoring and response: decide which events must be logged, how long records should be retained and who reviews alerts. Confirm whether the provider supplies logs, notifications or technical assistance, then maintain your own process for investigating suspected misuse and reporting relevant incidents.
- Governance and compliance: maintain policies covering acceptable use, access reviews, data handling, change control and supplier oversight. Your organisation remains accountable for demonstrating that its use of hosted infrastructure meets applicable contractual and regulatory requirements.
Security is also a shared operational process. The provider may maintain the security of the physical platform and its core service, while your team must use the available controls correctly. For example, a provider can offer private networking, encryption or audit logs, but those controls may provide limited protection if they are not enabled, configured correctly or reviewed.
Responsibility should therefore be documented in a control matrix rather than assumed. For each service component, record the responsible party, the required setting, the review frequency, the evidence produced and the action to take if the control fails. This makes gaps visible during onboarding, system changes and supplier reviews.
Ask the provider how it separates customer environments, protects management access, reports security incidents, tests its own controls and supports evidence requests. Also establish the customer actions required after an incident, such as preserving logs, resetting credentials, isolating workloads and notifying affected parties. These arrangements should be reflected in the contract and operating procedures, not left to informal understanding.
A practical IaaS security review should take place before workloads are moved and whenever the environment changes materially. It should cover access rights, exposed services, software maintenance, encryption and key ownership, logging, administrative devices, data locations, incident responsibilities and the evidence needed for audits. S2 Technology Group can help organisations assess these boundaries and turn them into workable policies, configurations and review processes.
Security responsibilities continue when an IaaS environment is retired. Your business must define how workloads, accounts and stored information are securely decommissioned rather than assuming that deleting a virtual machine removes every copy or access path.
- Revoke user, administrator, application and automation credentials that are no longer required.
- Remove obsolete firewall rules, network routes, public addresses and management connections.
- Confirm how data held in volumes, snapshots, replicas and backup repositories will be deleted or retained.
- Check that transferred or retained information remains subject to the correct privacy, contractual and regulatory controls.
- Keep evidence of the decommissioning activity, including approvals, dates and any exceptions that require further review.
These steps should be included in the organisation’s IaaS exit procedure and assigned to named owners. The provider may carry out technical deletion tasks, but the business remains responsible for specifying what must be removed, what must be preserved, and how completion will be verified.
