Which term is the sole responsibility of the client?

Which term is the sole responsibility of the client?

• A. Shared Responsibility Model
• B. External Environment
• C. Inherited Controls
• D. Customer/Client Specific Controls

Answer: (D)

The key idea is who must implement certain security controls in a service arrangement. Some controls are shared between the provider and the client, some are inherited through the system or third parties, and some are unique to the client because they arise from the client’s own data, regulatory obligations, and risk posture. The term that denotes controls the client must handle directly and exclusively is the client-specific controls. These are the protections the client is responsible for implementing within their own environment and data, such as how they classify data, set access policies for their applications, and manage their own encryption keys. The other phrases describe different relationships or concepts: the shared responsibility model splits duties between provider and client; inherited controls are those that come from a higher-level system or third party; and external environment isn’t a control designation. Therefore, client-specific controls are the ones that fall entirely on the client.

The key idea is who must implement certain security controls in a service arrangement. Some controls are shared between the provider and the client, some are inherited through the system or third parties, and some are unique to the client because they arise from the client’s own data, regulatory obligations, and risk posture. The term that denotes controls the client must handle directly and exclusively is the client-specific controls. These are the protections the client is responsible for implementing within their own environment and data, such as how they classify data, set access policies for their applications, and manage their own encryption keys. The other phrases describe different relationships or concepts: the shared responsibility model splits duties between provider and client; inherited controls are those that come from a higher-level system or third party; and external environment isn’t a control designation. Therefore, client-specific controls are the ones that fall entirely on the client.