A company migrates several application servers to a public cloud provider using an Infrastructure as a Service (IaaS) model. During a security review, the team debates who is accountable for various layers of the environment. Under the shared responsibility model, which task remains the responsibility of the cloud service provider?