To whom does the responsibility for security of a clients' environments in the IBM Cloud belong?

IBM Cloud adopts a shared-responsibility model: IBM secures the cloud infrastructure itself, while each customer is accountable for anything they deploy or configure inside that infrastructure (operating systems, applications, data, network controls). Because the question focuses specifically on “security of a clients’ environments in the IBM Cloud” (that is, the resources that the customer owns and manages inside the cloud), the responsibility rests with the client. IBM’s obligation ends at the underlying physical facilities, hardware, and managed platform services.

A. The OS vendor supplies patches but does not operate or secure the customer’s deployed environment in IBM Cloud.
B. IBM secures the cloud infrastructure, not the customer’s own workloads, data, and configurations.
D. While overall cloud security is shared, the portion concerning the customer’s own environment is solely the client’s duty, not jointly managed.

1. IBM Cloud Docs – “Security and compliance overview: Shared responsibility model,” Section “Security in IBM Cloud” (docs/overview?topic=overview-security).

2. IBM Cloud Virtual Servers Documentation – “Customer responsibilities,” para. 1 & 2 (docs/vsi?topic=virtual-servers-security).

3. IBM Cloud Security White Paper v3, §3.2 “Customer workload responsibilities,” pp. 9–10.

4. NIST SP 800-144 “Guidelines on Security and Privacy in Public Cloud Computing,” §3.1 (supports provider vs. tenant delineation).