Our cloud provider is certified. Why do we need to do anything?

Your provider’s assurance covers its stated scope. It does not establish that your accounts, application or use of the service are secure. You still need to understand and operate the controls assigned to you.

AWS’s shared responsibility model distinguishes the provider’s infrastructure responsibilities from the customer’s responsibilities. The division changes with the service: running a virtual machine leaves more operational work with you than using a managed service.

Check the exact service and scope

Obtain the relevant assurance document and check whether the service you use is covered. Read any exclusions and the reporting period or certificate validity. A logo on a vendor’s homepage will not answer those questions.

For a SOC report, examine any complementary user entity controls: the controls the provider expects its customers to operate. Assign the applicable work to someone in your organisation.

Identify your configuration decisions

Even where the provider manages the underlying infrastructure, your team may decide who gets administrative access, whether a storage location is public and how long data is retained. Record those decisions for each critical service.

For example, a provider can secure its data centre while your organisation accidentally gives an external collaborator access to a sensitive folder. The provider’s audit does not review every permission you grant.

Use the provider’s service-specific documentation to assign responsibilities. Do not copy a generic checklist and assume the same division applies to hosting, managed databases and business applications.

Test the outcome you depend on

If the provider offers backups, check what they cover and how restoration works. Establish whether you can restore a deleted record or recover after losing access to the tenant. Test the recovery scenario that matters to your business.

If the provider handles software updates, determine what remains yours to patch or configure. Document the remaining work so it does not disappear between the application owner and infrastructure team.

Keep provider assurance beside your own evidence

Retain the provider’s relevant report or certificate and record your review. Keep your own access checks and configuration reviews linked to the service. These records answer different parts of the same assessment.

Yrso’s vendor register and recurring checks can hold that context. Dedicated guided vendor reviews are on the roadmap. You still choose whether a supplier’s service and assurance meet your requirements.