Who will determine data classifications for the cloud customer?

The cloud provider offers services and infrastructure but does not have the inherent knowledge or responsibility to classify a customer's specific data content.

NIST (National Institute of Standards and Technology) provides frameworks and guidelines for data classification but does not perform the classification for individual organizations.

Regulators establish laws and compliance requirements, which inform classification decisions, but they do not directly classify an organization's data.

The cloud customer owns the data and is ultimately responsible for its security and compliance. Therefore, the cloud customer is the entity that understands the sensitivity, value, and regulatory requirements pertaining to their data and must determine its classification. This classification then informs the security controls and protection measures to be implemented.