Cloud computing operates on a shared responsibility model. That means an organization can't rely solely on the cloud provider's security controls to protect business applications and data. An organization must bear the responsibility of identifying any gaps that exist in the cloud provider's security and then fill those gaps.