| Hardware, cloud services and licensing | Sizes the environment, supplies or resells hardware, software and cloud services where contracted, and manages renewals | Supply hardware, software and cloud services under their own terms and warranties | Approves designs and capacity plans and funds them |
| Platform availability | Operates storage, compute and pipelines and restores service after failures | Keep their hardware and cloud services available under their own commitments | Provides facilities, power and network for on-premises deployments |
| Configuration | Builds and maintains the configuration baseline and checks for drift | Provide the underlying service configuration options | Approves the baseline and any changes to it |
| Identity and access | Connects your identity provider and applies role design | None beyond their own administrative access controls | Approves every access grant and runs access reviews |
| Monitoring | Monitors health, capacity and security events and forwards logs | Monitor their own infrastructure and services | Reviews escalated security events in your security operations |
| Incident response | Responds under the agreed runbooks and reports each incident | Respond to failures in their hardware or services | Leads security incident decisions and any reporting to authorities |
| Changes | Raises, tests and applies approved changes in agreed windows | Announce changes to their services | Approves or rejects changes through the ISSM |
| Patches and updates | Tests and applies patches on the agreed schedule | Publish patches and firmware for their products | Agrees the patch schedule and approves exceptions |
| Data and policy decisions | Applies the rules you set | None | Decides sources, access, handling, retention and use of analytic results |
| Authorization | Maps controls and supplies evidence for your package | Provide their own compliance documentation | Your authorizing official decides whether the environment may operate |