Service model
Serverless functions and event services: the shared responsibility split
The provider runs the servers, the runtime and the scaling. You run the function code and its dependencies, the permissions each function holds, the triggers that reach it and the data it touches.
Of the 14 control areas: 4 yours, 9 shared, 1 the provider's, before any category moves the line.
Every control area
Serverless| Control area | Owner | Why, and the clause |
|---|---|---|
GOV Governance and policy | shared | Each party governs its own side: the provider the service it delivers, you which data and services you allow and who may procure them. The allocation between you has to be written down. ISO/IEC 27017 6.1.1 |
IAM Identity and access | yours | The accounts, roles and second factors inside your tenancy are yours to grant, review and remove; the provider secures only its own staff's privileged access. ISO/IEC 27017 9.2.3 |
DAT Data classification and handling | yours | What the data is, how it is labelled and where it may go is yours on every model; the provider only tells you what labelling and location options the service offers. ISO/IEC 27017 8.2.2 |
KEY Encryption and keys | shared | The platform encrypts by default with keys it holds; choosing customer-managed keys, their rotation and who may use them is yours. ISO/IEC 27017 10.1.2 |
NET Network security | shared | The provider runs the platform's network and keeps tenants apart; the endpoints you expose, private connections and the rules on them are yours. ISO/IEC 27017 CLD.9.5.1 |
LOG Logging and monitoring | shared | The provider logs the platform and makes activity logs available; turning them on, sending them somewhere you keep and reviewing them is yours. ISO/IEC 27017 CLD.12.4.5 |
VUL Vulnerability and patch management | shared | The provider patches the platform and runtime; the code, libraries and container images you deploy onto it are yours to scan and fix. ISO/IEC 27017 12.6.1 |
CFG Configuration and hardening | shared | The provider hardens the platform it runs; every setting you choose in your tenancy, and a public or open default you leave on, is yours. ISO/IEC 27017 CLD.12.1.5 |
APP Application security | yours | The code you deploy is yours to build and test securely; the provider has no view of it. ISO/IEC 27017 14.2.1 |
INC Incident response | shared | Both sides respond: the provider must report incidents affecting your data within the agreed time, and you must detect and handle incidents in what you run and report to the provider what affects its service. ISO/IEC 27017 16.1.2 |
BCP Business continuity and backup | shared | The provider keeps the service available and may keep its own backups; whether you rely on those, keep your own copy and test the restore is yours to decide and prove. ISO/IEC 27017 12.3.1 |
PHY Physical and environmental | the provider's | The data centres, power, cooling, access to the floor and the disposal of retired media are the provider's; your evidence is its assurance report, not your own inspection. ISO/IEC 27017 11.2.7 |
SUP Supplier and subservice | shared | The provider must publish its side of the model and the suppliers behind the service; you must hold the matrix for your estate, read the provider's side and keep the agreement that binds both. ISO/IEC 27017 CLD.6.3.1 |
AIR AI use and data retention | yours | What data goes into the service, for what purpose and how long it is kept is yours to decide and delete; the provider stores what you give it. ISO/IEC 27017 CLD.8.1.5 |
Service categories delivered this way by default
1- Serverless functionscompute