When leveraging a cloud provider, what should be considered to ensure application security requirements are met?

Application security in the cloud must be viewed as a shared responsibility. Providers deliver basic

security features, but custom configurations and additional controls are often needed to meet

organizational requirements.

From CSA Security Guidance v4.0 – Domain 10: Application Security:

“Cloud consumers should not assume default security settings are sufficient. Security features

provided by cloud service providers often require additional configuration and hardening. Custom

security controls may be needed to address specific organizational risks and compliance needs.”

(CSA Security Guidance v4.0, Domain 10)