Shared responsibilities for using IBM Cloud products

In IBM Cloud®, as is the case for other cloud service providers, the responsibilities for managing the lifecycle of, operating, and securing products are shared between IBM® and the customer.

The responsibility of completing the following types of tasks on various products can be exclusive to IBM, the customer, or shared between the two. The tasks for each type of product are grouped in the following categories:

• Incident and operations management: Includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.
• Change management: Includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.
• Identity and access management: Includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.
• Security and regulation compliance: Includes tasks such as security controls implementation and compliance certification.
• Disaster recovery: Includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.

When you're reviewing the following sections, the tables list resources for each category and who manages them. The following list describes what constitutes each type of resource in IBM Cloud.

Data

Customer-owned content that includes all data that is managed and controlled by the customer. Examples include information that is stored into volumes, files, and databases hosted on IBM Cloud resources and data processed, stored, and logged by the client applications hosted on IBM Cloud. It doesn't include client metadata, the information that is used by IBM to provide services to the customer and support and operate the client account, services, and resources that are always considered to be shared responsibility between client and IBM.

Applications

Customer-owned software components, such as executables, web applications, middleware, frameworks, libraries, and other software packages that the client developed or acquired by third parties and deployed in IBM Cloud.

Service instance

An entity that consists of resources that are reserved for a particular service.

Operating systems

The operating system software and configuration that are deployed in virtual or bare metal servers, such as Linux, Windows, or similar to the ones provided in stock images.

Virtual and bare metal servers

The virtual or bare metal servers that are ordered and managed through IBM Cloud services.

Virtual storage

The block, file, or Object Storage buckets ordered and managed through IBM Cloud.

Virtual network

Network resources such as VLAN, VPC, subnets, or IPs provided by classic infrastructure and VPC services that are ordered and managed through IBM Cloud.

Hypervisor

The software and configuration that is deployed in physical servers to host and manage the lifecycle of virtual servers.

Physical servers and memory

The physical compute devices and resources, such as cores, memory, and GPUs used to host the virtual or bare metal servers.

Physical storage

The physical storage devices and resources, such as disks and storage devices that are used to host the virtual block, file, or Object Storage buckets.

Physical network and devices

The physical network devices and resources, such as switches, routers, gateways, firewalls, and load balancers that are used to host the virtual network resources.

Facilities and data centers

The physical data center buildings with power, cooling, and rooms for all the IBM Cloud physical equipment.

IBM Cloud supports the following types of products and the corresponding shared responsibility models. For more information about each specific service, see the documentation for that service.