The decision has been made, your organization is “going to the cloud”. But what aspects does an organization need to think about when it wants to use cloud services? We have created a Competence Center that deals with precisely this question! <\/h2><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>Shared responsibility: What your company remains responsible for (1)<\/h2>\n
First of all, it is extremely important to understand what a cloud service and therefore a cloud service provider (CSP) actually does. What is the product and how can it help me overcome my challenges? Next, it is important to understand that migrating to the cloud does not mean relinquishing responsibility (i.e. obligations) per se. <\/p>\n
According to the National Institute of Standards and Technology<\/em> (NIST), the definition of cloud computing provides for three service models: I can buy the hardware, which I would traditionally set up in a data center, as a service; in other words, the entire infrastructure “as a service” (IaaS for short). It is also possible to purchase platforms “as a service” (PaaS for short). The CSP not only provides the hardware, but also takes care of the provision and maintenance of the operating system. In a further level of abstraction, I can purchase software “as a service”, i.e. a specific application such as MS Excel. In this case, I don’t have to worry about keeping the operating system or the actual application up to date. In addition, there are almost endless variants of the three service models, including Function as a Service (FaaS), Backend as a Service or Everything as a Service (XaaS). Basically, no matter which service model you choose, you remain responsible for your own data and the data entrusted to you (as part of order processing). You simply outsource more or less of the work involved in meeting this responsibility. Each CSP has a more or less individual shared responsibility model. Basically, however, “shared responsibility” looks like this: In all service models, responsibility for the data center, the (physical) network and the hosts (i.e. physical servers) remains with the cloud service provider. If something fails, the CSP takes care of a replacement. But be careful: the replacement of the hardware, not the recovery of the data! In the IaaS model, you are responsible for the security of all components to be installed in the infrastructure, including the operating system, application, middleware, containers, network, workload, data and code. You are also responsible for protecting the availability of your data by implementing an appropriate backup strategy. As a rule, every CSP offers countless services for your IT department’s area of responsibility, which, for example, help with the encryption of your data in accordance with your cryptography concept. However, this does not go hand in hand with a transfer of responsibility. Secure configuration of all the cloud services you use remains your responsibility at all times. Your information security management system should take this shared responsibility into account. <\/p>\nA certainly helpful starting point is the Cloud Computing C5 criteria catalog<\/em> <\/a> of the Federal Office for Information Security. It provides characteristics that can be used to set up or evaluate a trustworthy and secure collaboration with a cloud service provider. CC Digital Security has also analyzed this catalog as a basis for our cloud service development (especially SaaS) and transferred it to the company. In this way, we ensure that applications that we provide as Software as a Service or prepare for operation as SaaS comply with these features. We have adapted our Secure<\/u> Software Development Lifecycle to include the creation of cloud-enabled or cloud-native applications. <\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div>![](\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%27425%27%20height%3D%27390%27%20viewBox%3D%270%200%20425%20390%27%3E%3Crect%20width%3D%27425%27%20height%3D%27390%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\" "\\"Secure")
<\/span><\/div><\/div><\/div><\/div><\/div><\/div>IT (security) governance: guidelines are also needed in the cloud (2)<\/h6>\n
Every organization sets framework conditions (organizational structures, processes, guidelines) for internal IT in order to enable it to implement the requirements as independently as possible. The applicability or viability of the framework conditions may be more or less impaired depending on the CSP and service model selected. IT governance (i.e. the framework conditions) must be adapted to the company’s own cloud strategy (including any hybrid cloud strategy). Business continuity management (BCM for short) and the emergency manual alone must be adapted to the new circumstances. SLAs with the CSPs must be coordinated with those of the in-house IT department. Emergency procedures may need to make provision for other parties to be involved in an emergency. <\/p>\n
The access control policy as part of IT governance also needs to be revised when migrating to the cloud. Identity & access management is considered one of the most important building blocks for secure use in cloud infrastructures. This is due to the “nature of the matter”: cloud operation generally means shared use of resources. I can access these resources from anywhere in the world. I no longer necessarily have to be in my own company’s network. What’s more, organizations that migrate to the cloud are building increasingly complex IT infrastructures, precisely in order to gain maximum efficiency from the use of the cloud infrastructure. It is no longer one firewall setting that protects my infrastructure, it is many different identities, many different users and services for which access rules need to be defined. <\/p>\n
There is no doubt that the threats posed by a cloud-based infrastructure are not the same as those posed by an on-premise infrastructure. The attack surface, the attack scenarios, the actors and also the possibilities change. Accordingly, the organization must also adapt its vulnerability and threat management. For which aspects can cloud service provider services be used? For which aspects are in-house or third-party solutions required? We are working on an effective threat identification and analysis service that is tailored to the customers in our business areas. Depending on the degree of integration, the service should not only focus on detection, but also on response. <\/p>\n
Furthermore, the specifications regarding logging\/monitoring\/alerting, cryptography and compliance must be adapted in the corresponding guidelines.<\/p>\n
<\/p>\n
Legally compliant in the cloud – what obligations do you have (3)<\/h6>\n
Moving your own applications to the cloud significantly changes the setup of your company’s IT infrastructure. Whereas with an on-premise solution the data can almost be touched, with a cloud solution it is difficult to track where it is located at all times (i.e. both in the database and during network transfer and actual processing). Against this backdrop in particular, it is important to be familiar with regulatory and legal requirements in order to ensure that they do not prevent your often economically driven decision to move to the cloud. In our Digital Security Competence Center, we have identified more than 30 references for our customer segments alone that are relevant to the transition of their own organization to a cloud infrastructure and thus have an impact on a possible deployment. It is also important to note that it is not only your organization that has legal obligations, but also your partners, such as the cloud service provider. It is important to ensure that these obligations do not conflict with each other. You can find a closer look at this challenge in our last Insight article Public cloud, private cloud, no cloud – where the public sector is heading<\/em> <\/a>. With the new EU adequacy decision<\/a>, there is now slightly improved legal certainty here.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>ALSO INTERESTING<\/h4>\n<\/div><\/div><\/div><\/span><\/a><\/span>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/06\/Westernacher-Solutions_Elektronischer-Rechtsverkehr1.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>Electronic Legal Transactions: How to Ensure a Successful Implementation<\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/span><\/a><\/span>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/06\/Westernacher-Solutions_eJustice.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>eJustice: Digitizing the Justice System for More Efficient and Secure Proceedings<\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/span><\/a><\/span>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/06\/Westernacher-Solutions_EUDI-Wallet.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>Digitization of Public Administration: How Government Documents Are Added to the EUDI Wallet<\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/span><\/a><\/span>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/06\/Synthetische_Daten.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>Synthetic data is not automatically secure: what really matters when it comes to data protection and AI<\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n<\/span><\/a><\/span>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/05\/Westernacher-Solutions_LLM-SLM.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>Trustworthy AI in administration: small models, big impact<\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n
Shared responsibility: What your company remains responsible for (1)<\/h2>\n
First of all, it is extremely important to understand what a cloud service and therefore a cloud service provider (CSP) actually does. What is the product and how can it help me overcome my challenges? Next, it is important to understand that migrating to the cloud does not mean relinquishing responsibility (i.e. obligations) per se. <\/p>\n
According to the National Institute of Standards and Technology<\/em> (NIST), the definition of cloud computing provides for three service models: I can buy the hardware, which I would traditionally set up in a data center, as a service; in other words, the entire infrastructure “as a service” (IaaS for short). It is also possible to purchase platforms “as a service” (PaaS for short). The CSP not only provides the hardware, but also takes care of the provision and maintenance of the operating system. In a further level of abstraction, I can purchase software “as a service”, i.e. a specific application such as MS Excel. In this case, I don’t have to worry about keeping the operating system or the actual application up to date. In addition, there are almost endless variants of the three service models, including Function as a Service (FaaS), Backend as a Service or Everything as a Service (XaaS). Basically, no matter which service model you choose, you remain responsible for your own data and the data entrusted to you (as part of order processing). You simply outsource more or less of the work involved in meeting this responsibility. Each CSP has a more or less individual shared responsibility model. Basically, however, “shared responsibility” looks like this: In all service models, responsibility for the data center, the (physical) network and the hosts (i.e. physical servers) remains with the cloud service provider. If something fails, the CSP takes care of a replacement. But be careful: the replacement of the hardware, not the recovery of the data! In the IaaS model, you are responsible for the security of all components to be installed in the infrastructure, including the operating system, application, middleware, containers, network, workload, data and code. You are also responsible for protecting the availability of your data by implementing an appropriate backup strategy. As a rule, every CSP offers countless services for your IT department’s area of responsibility, which, for example, help with the encryption of your data in accordance with your cryptography concept. However, this does not go hand in hand with a transfer of responsibility. Secure configuration of all the cloud services you use remains your responsibility at all times. Your information security management system should take this shared responsibility into account. <\/p>\n A certainly helpful starting point is the Cloud Computing C5 criteria catalog<\/em> <\/a> of the Federal Office for Information Security. It provides characteristics that can be used to set up or evaluate a trustworthy and secure collaboration with a cloud service provider. CC Digital Security has also analyzed this catalog as a basis for our cloud service development (especially SaaS) and transferred it to the company. In this way, we ensure that applications that we provide as Software as a Service or prepare for operation as SaaS comply with these features. We have adapted our Secure<\/u> Software Development Lifecycle to include the creation of cloud-enabled or cloud-native applications. <\/p>\n<\/div><\/div><\/div><\/div> Every organization sets framework conditions (organizational structures, processes, guidelines) for internal IT in order to enable it to implement the requirements as independently as possible. The applicability or viability of the framework conditions may be more or less impaired depending on the CSP and service model selected. IT governance (i.e. the framework conditions) must be adapted to the company’s own cloud strategy (including any hybrid cloud strategy). Business continuity management (BCM for short) and the emergency manual alone must be adapted to the new circumstances. SLAs with the CSPs must be coordinated with those of the in-house IT department. Emergency procedures may need to make provision for other parties to be involved in an emergency. <\/p>\n The access control policy as part of IT governance also needs to be revised when migrating to the cloud. Identity & access management is considered one of the most important building blocks for secure use in cloud infrastructures. This is due to the “nature of the matter”: cloud operation generally means shared use of resources. I can access these resources from anywhere in the world. I no longer necessarily have to be in my own company’s network. What’s more, organizations that migrate to the cloud are building increasingly complex IT infrastructures, precisely in order to gain maximum efficiency from the use of the cloud infrastructure. It is no longer one firewall setting that protects my infrastructure, it is many different identities, many different users and services for which access rules need to be defined. <\/p>\n There is no doubt that the threats posed by a cloud-based infrastructure are not the same as those posed by an on-premise infrastructure. The attack surface, the attack scenarios, the actors and also the possibilities change. Accordingly, the organization must also adapt its vulnerability and threat management. For which aspects can cloud service provider services be used? For which aspects are in-house or third-party solutions required? We are working on an effective threat identification and analysis service that is tailored to the customers in our business areas. Depending on the degree of integration, the service should not only focus on detection, but also on response. <\/p>\n Furthermore, the specifications regarding logging\/monitoring\/alerting, cryptography and compliance must be adapted in the corresponding guidelines.<\/p>\n <\/p>\n Moving your own applications to the cloud significantly changes the setup of your company’s IT infrastructure. Whereas with an on-premise solution the data can almost be touched, with a cloud solution it is difficult to track where it is located at all times (i.e. both in the database and during network transfer and actual processing). Against this backdrop in particular, it is important to be familiar with regulatory and legal requirements in order to ensure that they do not prevent your often economically driven decision to move to the cloud. In our Digital Security Competence Center, we have identified more than 30 references for our customer segments alone that are relevant to the transition of their own organization to a cloud infrastructure and thus have an impact on a possible deployment. It is also important to note that it is not only your organization that has legal obligations, but also your partners, such as the cloud service provider. It is important to ensure that these obligations do not conflict with each other. You can find a closer look at this challenge in our last Insight article Public cloud, private cloud, no cloud – where the public sector is heading<\/em> <\/a>. With the new EU adequacy decision<\/a>, there is now slightly improved legal certainty here.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>![](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2025\/06\/CloudStrategie-01.svg\" "\\"Secure")
IT (security) governance: guidelines are also needed in the cloud (2)<\/h6>\n
Legally compliant in the cloud – what obligations do you have (3)<\/h6>\n
ALSO INTERESTING<\/h4>\n<\/div><\/div><\/div>
<\/span><\/div><\/div><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/span><\/div><\/div><\/div><\/div>
![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/04\/Westernacher-Solutions_Souveraene_KI.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>![\"Westernacher](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/04\/Westernacher-Solutions_Digitale-Identitaeten.jpg\" "\\"Westernacher")
<\/span><\/div><\/div><\/div><\/div>![\"Law](\"https:\/\/westernacher-solutions.com\/wp-content\/uploads\/2026\/04\/Kanzlei-Digitalisierung.jpg\" "\\"Law")
<\/span><\/div><\/div><\/div><\/div>