An organization has migrated all workloads to the cloud and is reviewing their cloud security posture. Who is now responsible for securing the physical infrastructure of the data centers?

Physical infrastructure security is not a shared responsibility - it belongs entirely to the CSP, not jointly with the customer organization.

Third-party security providers do not own or control physical data centers and bear no responsibility for their physical security.

The cloud shared responsibility model explicitly assigns physical data center security - including buildings, hardware, and physical networks - to the cloud service provider. The organization retains responsibility for their data, identity, and application-level security, but physical infrastructure protection is always the CSP's domain regardless of the service model used.

The organization does not own or have physical access to cloud data centers, so physical infrastructure security cannot be their responsibility.