Security Responsibility Matrix

Source: Microsoft

The Security Responsibility Matrix can be used to understand the division of compliance responsibility between Microsoft and its hosted services customers. In this illustration, rows with key security responsibilities (left) are aligned with columns (top) for on-premises systems and three types of Microsoft’s hosted services: Infrastructure as a Service (IaaS, such as Azure Virtual Machines [VMs]), Platform as a Service (PaaS, such as machine learning), and Software as a Service (SaaS, such as Office 365 and Dynamics CRM). The rows and columns form a matrix of security responsibilities (center).

This matrix includes the following general responsibilities (from the bottom up):

Physical security of the data center, network, and hosts. Responsibility for securing the actual data centers where the applications and services run, including responsibility for controlling and monitoring access to the physical servers or hosts, the physical network equipment and cables, and the actual data center facility.