SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly

"SLAs typically cover metrics like uptime, support response times and service performance, but often overlook critical elements such as data protection, breach response and regulatory compliance. This creates a responsibility gap, where assumptions about who is accountable can lead to serious blind spots. For instance, a customer might assume that the cloud provider's SLA guarantees data protection, only to realise that their own misconfigurations or weak identity management practices have led to a data breach."

"Cloud providers secure the infrastructure they manage; you ensure what you deploy. Customers are responsible for data, configurations, identities and applications. Customers must secure the stack themselves, as cloud doesn't equal safe-by-default -visibility, policy and controls are still on you. While an SLA guarantees the cloud provider's commitment to "the security of the cloud", ensuring the underlying infrastructure's uptime, resilience and core security, it explicitly does not cover the customer's responsibilities for "security in the cloud.""

The shared responsibility model defines how security and operational duties split between cloud providers and customers. Service level agreements typically cover uptime, support response times and service performance but often omit data protection, breach response and regulatory compliance. Omissions in SLAs create responsibility gaps and blind spots where assumptions about accountability increase risk. Customers sometimes assume provider SLAs guarantee data protection, yet misconfigurations and weak identity management commonly lead to breaches. Cloud providers secure the infrastructure they manage while customers remain responsible for data, configurations, identities and applications. Providers may invoke the model to deflect blame during incidents, making clarity about responsibilities essential. Visibility, policies and customer-side controls are necessary to meet compliance and maintain operational resilience.

Read at ComputerWeekly.com