If a provider's infrastructure is not in scope, who is responsible for building compliant applications and services?

The cloud shared responsibility model dictates that compliance obligations are divided based on what each party controls. When the provider's underlying infrastructure is not in scope for a given compliance framework, the customer must independently design, implement, and operate their applications and services to satisfy those requirements. The customer cannot rely on the provider to fulfill compliance obligations that fall outside the agreed-upon scope.

Scope boundaries are established during contract negotiation; once infrastructure is defined as out of scope, ongoing negotiation does not shift or share the customer's resulting compliance burden.

If the provider's infrastructure is not in compliance scope, the provider has no contractual or regulatory obligation to remediate compliance gaps on the customer's behalf.

Compliance requirements cannot simply be accepted as risk and buried in terms and conditions; customers remain legally and contractually accountable for meeting applicable standards.

Provisioning separate tenants per customer is a multi-tenancy architecture decision, not a mechanism that transfers or satisfies the customer's responsibility to build compliant applications.