Four moves improve cloud security and compliance together: agree who is responsible for each control, keep a live inventory of resources, tighten identity and encryption keys, and collect evidence continuously rather than before an audit. Each reduces risk and also gives an auditor something to check.
1. Who is responsible for what?
The UK NCSC's guidance on the shared responsibility model says there is joint responsibility for the security and availability of data and workloads, split between provider and customer, and that the split depends on the service type and how the provider has built it. The provider almost always owns physical protection and availability of its servers. Application security depends on the service: far more is yours on virtual machines than on a managed platform.
NIST SP 800-144, on public cloud computing, lists considerations for organisations that outsource data, applications and infrastructure to a public cloud. Write a simple table per service: control, provider, you, evidence. Gaps show up quickly. The NCSC adds a practical line: you will always be responsible for making sure the service can meet your needs and for configuring it securely.
2. What do you actually run?
You cannot secure or evidence what you cannot list. Keep an inventory of accounts, projects, storage, databases, functions, and the people and services with access. Tag by owner and data sensitivity. Alert on new resources that appear without a tag.
NIST SP 800-53 Revision 5 is a catalogue of controls used well beyond US government. Asset inventory, configuration management and access control each have families in it. Use it as a checklist for what an assessor will ask, even if no framework applies to you yet.
3. Who and what can reach your data?
Identity is the control that matters most in the cloud, since resources are reached by API. Require multifactor login for people, remove long-lived keys, grant narrow roles to services, and review access on a schedule. Encrypt storage and manage keys with clear ownership. NIST SP 800-57 covers key management, including key lifetimes and who may use a key.
4. Can you prove it today?
Many teams scramble before an audit, taking screenshots. Better: record the evidence as a by-product of normal work. Configuration checks that run daily, access reviews with a saved record, change approvals in your pipeline. The NIST Cybersecurity Framework 2.0 organises outcomes under Govern, Identify, Protect, Detect, Respond and Recover, which gives a shared vocabulary for linking technical checks to the outcomes auditors care about.
What does a constructed example show?
A startup stores customer exports in a cloud bucket. Under step 1, the table shows that bucket access is entirely theirs. Under step 2, the inventory finds three buckets nobody tagged. Under step 3, one has a service key last rotated two years ago. Under step 4, they add a daily check for public access and keep the output. The same work satisfies the access-control questions on their next customer security review.
Why do the four work as a set?
Each move feeds the next. The responsibility table tells you what to inventory. The inventory tells you which identities and keys to review. The identity review produces records you can keep as evidence. Skipping a step breaks the chain: teams that start with evidence collection before settling ownership end up with a pile of screenshots nobody can interpret. Order matters more than speed, and a small first pass through all four beats a deep dive into one.
How to check or apply this
- Draw the responsibility table for your three most-used cloud services.
- Export a list of all resources, find the untagged ones and assign owners.
- Turn on multifactor login everywhere, and list every long-lived key.
- Pick one framework you will be asked about, and map five controls to automated checks.
- Save check results on a schedule. Keep them for your audit period.
- Review the table each quarter, and whenever you adopt a new service.
Safeguard offers compliance automation that maps checks to frameworks, which can feed step 4. It does not certify you.
Quick check
Does using a compliant cloud provider make me compliant?
No. The provider's certifications cover the parts it runs. Your configuration, data and access remain yours to secure and show.
Which of the four should come first?
Start with responsibility. It tells you what the other three need to cover.
Sources
- NCSC, Cloud security shared responsibility model
- NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management
- NIST Cybersecurity Framework
Last reviewed: 18 October 2026.
