CLOUD INFRASTRUCTURE
- Inheritance is per control, not per system.
- Shared controls are where most findings originate.
- Start from the control responsibility matrix, not from the control catalog.
Three categories, not two
Teams often assume a control is either inherited or theirs. In practice there are three categories, and the middle one causes most trouble.
Fully inherited controls are satisfied entirely by the hosting layer. Physical access controls are the clearest example: you do not implement PE-3, we do, and our evidence covers it.
Customer controls are entirely yours. Your application's authorization logic is not something a hosting provider can implement on your behalf.
Shared controls are where the hosting layer implements part of a control and you implement the rest. AC-2, account management, is shared: we manage platform accounts, you manage application accounts. An assessor will want evidence for both halves, and a gap on your side is a finding even though the control appears in our authorization package.
Work from the matrix
Your onboarding pack contains a control responsibility matrix stating, control by control, which category applies. Start there rather than reading the full NIST catalog and reasoning from first principles.
For each control the matrix marks shared or customer, write down what you implement and where the evidence lives. Do this while you build, because reconstructing it before an assessment is considerably more work.
Controls that are usually underestimated
- AU-2 and AU-6. We retain platform audit records. Your application's audit records are yours to generate, retain, and review.
- CM-6. Your operating system configuration is yours. The inherited baseline stops at the hypervisor.
- IA-2. Platform authentication is ours. Application authentication, including multi-factor for privileged application users, is yours.
- CP-9. We provide the durable storage. Whether your data is actually backed up, and whether the restore works, is yours.
- SI-2. Firmware and hypervisor patching is ours. Operating system and application patching is yours.
If a control appears in our authorization package, that does not mean your assessor will not ask you about it. Inheritance reduces the work, it does not remove the conversation.
Requesting evidence
Evidence packages for inherited controls are available through the Client Portal under Compliance. Assessment reports are available under NDA. Request both early: assessors ask for them at the start of fieldwork, and a delay there delays everything after it.