Within the shared responsibility model, while the cloud provider is in charge of securing the infrastructure that runs the services, the user retains the responsibility of securing the operating system including the application of patches and updates. Specifically, this means regular patch management and security configurations must be performed by the user, not the provider. The provider typically does not manage individual guest operating systems or applications. Physical security and infrastructure are handled by the provider, and while the user configures services such as identity and access management, the actual infrastructure and security of the service itself remains the provider’s responsibility.