Shared Responsibility Model
LEGAL CENTER
This matrix sets out how responsibility for Cloud Drive Mapper (CDM) and IAM Cloud-hosted services is shared between IAM Cloud and the Customer. If you buy through an IAM Cloud partner, see also the Partner Shared Responsibility Model.
IAM Cloud – Customer Shared Responsibility Matrix
| Responsibility | IAM Cloud | Customer |
|---|---|---|
| CDM software and hosted service | Develop, secure, maintain & support CDM. Operate IAM Cloud-hosted components including Iris and Bifrost (the API). | Use the service in accordance with supported configurations and maintain the security of the Customer computing environment. |
| Customer endpoints / VDI | Publish supported platforms, prerequisites and deployment requirements. | Secure and maintain endpoints, operating systems and environments on which CDM is installed. |
| Deployment and configuration | Provide supported deployment methods, configuration capability and documentation. | Plan, configure, deploy and test CDM within the Customer environment. |
| Software updates and supported versions | Release supported updates, security fixes and lifecycle information. | Deploy applicable updates and maintain a supported CDM version. |
| Microsoft 365 tenant and Customer content | Integrate with Microsoft 365 using the documented permissions and security model. | Secure and administer the Microsoft 365 tenant, identities, permissions, content and associated data-protection controls. |
| Microsoft Entra authentication and consent | Define the authentication model and permissions required by CDM. | Configure and administer Entra identities, and authentication protocols based on organisational policy. |
| Iris administration | Secure and operate the Iris platform and provide administrative roles, permissions and authentication controls. | Control authorised Iris administrators, assigned roles and Customer configuration. |
| Bifrost API and tenant isolation | Secure and operate Bifrost, including authentication, authorisation and tenant-isolation controls. | Protect credentials/licence information and use APIs/integrations only for authorised and supported purposes. |
| Network connectivity | Publish required service endpoints, protocols and connectivity requirements. | Configure and maintain network services and connectivity required by CDM. |
| Customer data and privacy | Protect and process information received by IAM Cloud in accordance with applicable contractual and data-protection obligations. | Determine the lawful use of Customer data and minimise personal/confidential information supplied to IAM Cloud where possible. |
| Service monitoring and availability | Monitor and operate IAM Cloud-hosted service components and respond to service issues. | Monitor Customer endpoints, networks, Microsoft 365 and other Customer-controlled dependencies. |
| Support and diagnostic information | Provide support capability and protect diagnostic information received through IAM Cloud support channels. | Provide relevant logs and diagnostic information required for troubleshooting and avoid supplying unnecessary sensitive information. |
| Fault diagnosis and investigation | Perform fault analysis / incident investigation based on the documented behaviour and performance of CDM. Raise bugs where unexpected behaviour is identified. | Perform environmental investigation and diagnosis on the Customer estate and computing components where CDM is deployed. |
| Backup and recovery | Maintain appropriate resilience and recovery arrangements for IAM Cloud-hosted service components and data. | Maintain appropriate backup/recovery arrangements for Microsoft 365 source data, endpoints and Customer-controlled systems. |
| Security incident response | Investigate and respond to incidents affecting IAM Cloud-controlled services and notify/cooperate with Customers where required. | Investigate incidents within the Customer environment, notify IAM Cloud where the service may be affected, and cooperate with investigation where necessary. |
| Licensing and acceptable use | Provide and validate licensing and enforce applicable service, acceptable-use and fair-use terms. | Protect licence/credential information and use the service within authorised, licensed and contractual terms. |
Customer definitionCustomer means the Customer and any third party authorised by the Customer to manage, administer, support or operate the Product or the Customer’s computing environment on its behalf.