The Shared Responsibility Model & Microsoft 365

Shared Responsibility Model MS 365 Security

The shared responsibility model. You may have heard of it, but do you know what it is or what it means for your business? Before we jump in, there are a few things that you need to understand about your cyber security. 

With more and more businesses using cloud services like Microsoft 365 (MS 365), they are starting to become the standard. And though we do recommend the use of the cloud, you must also assess your risks when using these platforms. Take a minute to think about what could happen, even if you think there is little to no chance a breach or cyber attack could happen to you, they need to be considered.

We often hear businesses say that they don’t need to worry about cyber security because they’ve never been breached or hit with ransomware. Former IBM Ginni Rometty said cybercrime “the greatest threat to every profession, every industry, every company in the world.”  and Former FBI Director James Comey said “There are two kinds of companies in the United States. There are those who’ve been hacked … and those who don’t know they’ve been hacked.” 

At this point, the discussion about cyber attacks should be based on the assumption that every business will eventually by affected. It’s time make cybersecurity a priority and to protect your organization, employees and clients.

Not sure if your 365 is secure? Download this free checklist.

What Is the Shared Responsibility Model?

In an on-premises datacenter you are responsible for everything including security.  As you move workloads to the cloud, some responsibilities transfer to the Cloud Service Provide (CSP), hence the concept Shared Responsibility model.

When moving workloads to the cloud  it’s critical to understand the shared responsibility model including which security tasks the CSP is responsible for and and which tasks your organization is responsible for.  They will vary depending on whether the workload is hosted on Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), or in an on-premises datacenter

With cloud services improving and evolving, people often use them with blind trust and a lack of understanding of who is responsible for what. They assume that because the technology is advancing, they are going to be kept safe when using the cloud. But that is typically not the case when you are running with the default settings.

It’s On YOU: Cloud Security

Cloud services are not responsible for protecting your information. That bears repeating. It is your responsibility to keep your business safe. Understanding your risks is critical, because breaches, ransomware and other attacks are not scary hypotheticals, they actually happen with increasing regularity and impact. You need to understand what the cloud will do to assist you in protecting yourself, and what you need to take upon yourself.

Microsoft 365 Shared Responsibility Model

With Microsoft 365, there are a variety of aspects to the shared responsibility model. Here are the most critical to take into your own hands:

  • Microsoft 365 is NOT obligated to protect the loss of your data in the instance of an app outage. Though Microsoft takes many measures to keep service up and running, in the instance of an outage, there may be a loss of your data. You need to know that Microsoft is not liable for this. Microsoft makes it clear that in order to keep your data safe, you should back it up with a third-party application
  • Microsoft is NOT liable for data loss due to a deprovisioned user account. Their policy states that information is kept for 90 days after the termination of an account. If you terminate your MS 365 account and do not retrieve or back up your information with a third party, it will be permanently lost after the 90-day period is up. 
  • Microsoft is NOT liable for data loss as a result of data that was inadvertently or maliciously deleted.  If a user accidentally or maliciously deletes data and it is not discovered for more than 90 days, it is lost forever.

Backups aren’t the only security concern. Microsoft 365 comes with a variety of security features, but it is up to you to configure them for your business. Check out the 21 critical controls we recommend in our Microsoft 365 Security Checklist.

Now What?

After hearing about what actions you need to take, you might be wondering where to start. We recommend Datto SaaS Protection, which is  a powerful and secure backup solution for your MS 365 tenant. If you want to learn more, feel free to contact us or book a no-obligation consultation so we can help. 

We’ve also created the Microsoft 365 Security Checklist to help you make sure your MS 365 Security is configured correctly. It’s a free resource that could save you time, money and damage from a cyber attack.

Download the Checklist

Intrust IT Intrustimonials

Intrust Man

Intrust Man may be small, but he is mighty smart. You can trust this clever cartoon hero to provide news you can use.

Share this Blog

Not Sure Where To Start Looking for an MSP?

Our Managed IT Checklist will help you choose the right IT provider.

Get the checklist

Explore the Latest Trends in IT

Google Workspace Vulnerability Risk Assessment

Google Workspace Vulnerability Risk Assessment

Have you or your company considered going through a Google Workspace vulnerability risk assessment? You wouldn’t be the first to...
social engineering threat trends

Don’t Be Fooled by These Social Engineering Threat Trends

Social engineering is the primary cause of cyberattacks today, so it is critical to keep your team informed of the...
Intrust Nine Days Away from Keyboard Initiative

Nine Days Away From Keyboard Initiative

At Intrust IT, we understand the importance of taking time off to recharge and refresh, just like Ferris Bueller did...
9 Phishing Scam Prevention Tips

9 Phishing Scam Prevention Tips

If you’ve been on the Internet or working at a desk job, you’ve likely heard the term “phishing” thrown around...
Azure vs Aws

Azure vs AWS: Which Should I Choose?

The Azure vs AWS debate is a complex one to handle. You’re likely thinking about which cloud architecture of the...
Cloud Organization Tips

8 Best Cloud Organization Tips (And Why You Should Use Them)

The cloud makes it easy to share, store and manage files, but without routine maintenance, it can become messier than...