When deploying workloads on the cloud, security is a shared responsibility. Cloud providers are responsible for the security of the cloud, such as physical security, instance isolation, and protection for foundation services. The customer is responsible for security on the cloud, meaning you must secure your applications and data deployed on your instances.

It is important to understand that securing the cloud is not limited to protecting servers and applications. The cloud has many security settings controls that must be set properly, and misconfigurations can present risks to the security of applications and data.

Compliance standards and laws are designed to audit or test the level of security present and functioning to protect the valuable data that is on the cloud. However, compliance itself does not mean the cloud instance is secure.