A cloud service changes who runs parts of the infrastructure. It does not transfer every security decision to the provider. The customer still needs to understand the accounts, data and settings under its control.
Canada’s Cyber Centre describes the shared-responsibility model across infrastructure, platform and software services. The division changes with the service, but customer responsibility for user access and data remains a central part of the model.
Three settings worth reviewing
Start with public exposure. Identify the storage, databases and administrative interfaces intended to answer requests from the internet. Compare the actual configuration with that intention. A login screen does not, by itself, explain why an administrative interface should be publicly reachable.
Then examine standing administrative access. Name the owner and purpose of each privileged identity, including service accounts. Review rights that no longer match the work being performed. Plan changes carefully so removing an unnecessary permission does not disable a required service.
The original cover cites one NSA/CISA network assessment in which an elevated account enabled a domain compromise in under a business day. That is a specific assessment result, not a prediction for every cloud tenant.
Finally, examine authentication. Ask whether administrators use strong, appropriate multifactor authentication and how recovery is handled. A documented exception deserves an owner and a review date.
The region is also a business decision
Alberta’s guidance says that organizations using service providers outside Canada must explain relevant countries and purposes in their policies and practices, and tell individuals how to obtain that information and contact someone who can answer questions.
That makes the region selection more than a technical dropdown. Map the provider and processing location to the business’s actual privacy obligations, with counsel where necessary.
Record the findings and the changes they require. This is a focused review of configuration and responsibility, not a claim that three checks prove the cloud is secure. This article is not legal advice; obligations depend on jurisdiction, sector and facts.