Shared responsibility model

Purpose

Clarify the division of responsibilities between the SBI team and agencies.

SBI team responsibilities

• Develop and maintain hardened base images.
• Ensure compliance with IM8 policies and CIS controls.
• Pre-install and configure approved security agents.
• Conduct rigorous testing, maintain version control, and publish advisories.

Agency responsibilities

• Validate SBI compatibility with local infrastructure.
• Manage user accounts, access, and monitoring.
• Apply agency-specific security requirements.
• Conduct environment-specific security assessments.
• Accessing SBI AMIs in AWS:
  • SBI AMIs are refreshed weekly based on the latest CSP-provided images and treated with hardening scripts.
  • Agencies can request access to these AMIs through their AWS accounts.
  • While SBI AMIs reduce the effort required to meet compliance, they are not sufficient on their own to pass all security assessments. Agencies must apply additional configurations and controls to achieve full compliance.

Shared responsibilities

• Incident Management – SBI provides baseline controls; agencies monitor/respond to incidents.

• Vulnerability Management – SBI provides scanning tools; agencies remediate environment-specific issues.

• Change Management – SBI manages base image updates; agencies manage downstream changes.

• Compliance Reporting – SBI documents baseline; agencies document their implementation and exceptions.

Outcome

Security is a joint effort. SBI reduces agency effort by providing a strong foundation (e.g. hardened AMIs in AWS), but agencies remain accountable for completing the compliance journey and tailoring security to their environments.