While the cloud consumer is responsible for implementing the security controls, the cloud provider implements the security of the workload.