CISSP 9.1 - Shared Responsibility

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series unpacks the principle of shared responsibility, a Domain 3 idea built on a simple truth: you never secure a system alone. It traces where your duty starts and where someone else’s begins — inside your organization, across the seam with a cloud provider, and out into the wider security community.

Frequently Asked Questions

What does shared responsibility actually mean?

It means no organization stands alone. You run the same operating systems as everyone else, speak the same protocols, and lean on the same off-the-shelf and open source building blocks, and that shared foundation means you inherit shared exposure. Like a city water supply, every household draws from the same pipes, so keeping the water clean is a duty spread across all of them.

Who inside your own organization owns a piece of it?

Everyone does, at their own level. Security leadership sets the direction and stands up the controls, regular staff carry it by doing their jobs inside the guardrails those controls create, and auditors carry it by watching for violations and confirming the rules actually hold. Leadership also owes stakeholders sound decisions that keep the business standing.

How does the responsibility split when you move to the cloud?

The provider secures part of the stack and you secure the rest, so both sides must agree on the seam. This is the cloud shared responsibility model, and misreading it is a classic mistake. A provider might lock down the physical data center and the hypervisor, while you stay on the hook for your data, your access rules, and your configurations.

What do you owe the wider community when you find a new threat?

You owe responsible disclosure. When you uncover a fresh vulnerability or a live threat, the ethical move is to report it to the affected vendor or to a threat intelligence source. Sitting on it quietly leaves everyone else exposed to the same flaw.

How does the industry share threat data at machine speed?

Through automated indicator sharing, a government-backed effort to swap indicators of compromise and threat intelligence between the public and private sectors quickly and automatically. An indicator pairs an observed fact with a hypothesis about a threat, and an observable might be a malicious file identified by its hash. The plumbing uses two paired standards: a common structured language for describing cyberthreats, and a definition of how systems exchange that structured information.

Reference: This article is based on concepts discussed in CISSP 9.1 - Shared Responsibility.