What do shared responsibility models in cloud governance define?

• A. They assign all responsibilities to the provider.
• B. They outline which security and compliance tasks are performed by the cloud provider vs the customer.
• C. They define service-level objectives.
• D. They define pricing across providers.

Answer: (B)

Delimiting who handles security and compliance tasks in the cloud is the essence of the shared responsibility model. The provider is responsible for the security of the cloud itself—the underlying infrastructure, foundational services, and platform controls—while the customer is responsible for security in the cloud—protecting data, managing access, configuring security controls, and ensuring compliance for their workloads and applications. This clear boundary helps organizations assign ownership, implement appropriate controls, and monitor risk across both sides.

This is why the correct choice is that the model outlines which security and compliance tasks are performed by the cloud provider versus the customer. It precisely captures the division of responsibilities.

Reasons the other ideas don’t fit: placing all responsibilities with the provider ignores the customer’s role in securing data and configurations; service-level objectives pertain to performance targets rather than responsibility boundaries; and pricing across providers deals with cost, not security and compliance ownership.