Shared responsibility security and operational model
Adobe Commerce on cloud infrastructure is a platform-as-a-service (PaaS) offering that relies on a shared responsibility security and operational model. These responsibilities are shared between Adobe, the merchant, the cloud service provider, and the content delivery network (CDN) provider. Each party bears distinct responsibility for securing and operating the Adobe Commerce application and the merchant-specific code and extensions deployed on cloud infrastructure.
This shared model enables merchants to design and implement a highly flexible, customizable, and scalable solution to meet their business requirements while minimizing operational responsibilities and costs.
In general, Adobe is responsible for the following:
- Developing and maintaining secure core application code
- Maintaining the security of the platform
- Ensuring that the platform is SOC 2 and PCI compliant and compatible with PCI-compliant technology components (for example, PHP, Redis)
- Responding to security issues concerning the core platform
- Working with cloud service providers and CDN partners to resolve any issues that occur
Merchants are responsible for the following:
- Maintaining security for custom code and integrations with third-party applications
- Ensuring secure application development
- Obtaining PCI certification if requested by the merchant’s payment processor
- Reacting and responding to security incidents
Adobe responsibilities
Adobe is responsible for the security and availability of the Adobe Commerce on cloud infrastructure environment and the core solution code. In addition, Adobe is responsible for the necessary activities and mechanisms that maintain the security of the Adobe Commerce on cloud infrastructure solution, including:
- Applying server-level security and patches for applications supported by Adobe Commerce on cloud infrastructure, such as cloud data storage and search capabilities
- Conducting penetration testing and scanning of the core Adobe Commerce on cloud infrastructure code
- Conducting semi-annual reviews and audits of public cloud service providers’ identity and access management (IAM) solutions and permissions management (PCI compliance requirement)
- Conducting semi-annual reviews and audits of authorized users, including Adobe employees and contractors (PCI compliance requirement)
- Conducting annual testing and documentation of backup and restore functionality
- Configuring server and perimeter firewalls
- Connecting and configuring the Adobe Commerce on cloud infrastructure repository
- Defining, testing, implementing, and documenting disaster recovery (DR) plans for the areas within Adobe’s scope of responsibility
- Defining global platform web application firewall (WAF) rules
- Hardening the operating system (OS)
- Implementing and maintaining the integration of content distribution network (CDN) and application performance management (APM) solutions with Adobe Commerce on cloud infrastructure
- Issuing periodic security and other updates for the core Adobe Commerce on cloud infrastructure code (applying patches is the merchant’s responsibility)
- Managing merchant support and support access controls (for example, Zendesk)
- Monitoring, logging, and remediating security incidents concerning the Adobe Commerce on cloud infrastructure platform infrastructure
- Monitoring platform operations and providing 24/7 support for Adobe Commerce on cloud infrastructure merchants
- Provisioning the production and staging environments
- Assessing potential security threats to platform operations and infrastructure
- Scaling computing, storage, grid, and other resources, as described in the service-level agreement (SLA) with the merchant
- Setting up DNS (Adobe Commerce on cloud infrastructure platform infrastructure only)
- Testing the platform for security vulnerabilities
Adobe maintains PCI certification for the infrastructure and services used for the Adobe Commerce solution. Merchants are responsible for the compliance of custom code, system and network processes, and the organization.
Adobe also ensures the availability of the merchant’s infrastructure as agreed upon in the applicable SLA.
Merchant responsibilities
The merchant is responsible for following security best practices for their specific, customized instance of Adobe Commerce on cloud infrastructure solution:
-
Adding the necessary Adobe Commerce on cloud infrastructure configuration files to the repository
-
Applying security and other patches to their custom Adobe Commerce on cloud infrastructure solution immediately following their release by Adobe
-
Applying security and other patches to all custom extensions and code, immediately following their release by the vendor
-
Creating, deploying, and testing custom Varnish VCL files
-
Designing, theming, installing, integrating, and securing the customized Adobe Commerce on cloud infrastructure solution, including all custom extensions and code
-
Granting and revoking user access to the merchant’s instance of the Adobe Commerce on cloud infrastructure configuration, application, and platform
-
Handling security issues related to the merchant’s internal network, servers, infrastructure, and any custom applications built on the Adobe Commerce on cloud infrastructure platform
-
Installing the Adobe Commerce on cloud infrastructure command-line integration (CLI) tool
-
Maintaining the required level of PCI compliance of the customized application and other internal processes, as defined by the PCI-DSS guidelines
note note NOTE To minimize the areas that must be reviewed, PCI compliance for the merchant is built on the PCI certifications of Adobe Commerce and the cloud hosting provider. -
Running PCI ASV scans and remediating issues in the core Adobe Commerce on cloud infrastructure code and platform
-
Monitoring all application activities that might reveal a potential security threat, including penetration testing, vulnerability scans, and logs
-
Monitoring and responding to security incidents, including forensics, remediation, and reporting related to the merchant’s Adobe Commerce on cloud infrastructure solution and user accounts
-
Obtaining a DNS provider and configuring and maintaining any merchant-specific DNS records
-
Running performance tests on the customized application
-
Securing access to the platform accounts, instance access, and application
-
Testing and QA of the custom application
-
Maintaining the security of any systems or networks the merchant connects to the Adobe Commerce on cloud infrastructure application
Cloud Service Provider responsibilities
Adobe relies on well-established cloud service providers to host the cloud server infrastructure for Adobe Commerce on cloud infrastructure. These providers are responsible for security of the network, including routing, switching, and perimeter network security via firewall systems and intrusion detection systems (IDS). Cloud service providers are also responsible for the physical security of data centers that host the Adobe Commerce on cloud infrastructure solution and the environmental security of data centers.
Cloud service providers are also responsible for:
- Maintaining PCI DSS, SOC 2, and ISO 27001 certifications for their cloud services
- Securing the hypervisor
- Securing the data center, including both physical and network access
CDN provider responsibilities
The Adobe Commerce on cloud infrastructure solution uses CDN providers to speed page-load time, cache content, and instantly purge outdated content. These providers are also responsible for security issues directly related to or affecting their CDN, and for defining and maintaining CDN WAF rules.
Security responsibilities summary
The following summary table uses the RACI model to show the security responsibilities shared between Adobe, the merchant, and the Cloud service provider:
R — Responsible
A — Accountable
C — Consulted
I — Informed
(For example, Nginx or MySQL.)
1 Only if the Adobe Commerce on cloud infrastructure repository is used as the main repository. Use of other external repositories is the sole responsibility of the merchant.
2 Adobe provides Level 1 support for issues with CDN providers.
3 The merchant is responsible for any Ngnix controls that they configure for their applications.
4 For PCI, penetration testing requirements are shared between Adobe and the merchant.
Operational responsibilities summary
The following summary tables clarify the operational responsibilities for Adobe and Merchants when developing, deploying, maintaining, and securing Adobe Commerce on cloud infrastructure.
Coding and development
Core Adobe Commerce code
Code repository
Cloud Docker
Commerce Cloud CLI
Customizations
Deployments
Synchronizing environments
Merchants are responsible for synchronizing data between environments.
Patching
Website availability
Performance
Logs and monitoring
APM application and agent integration, Infrastructure application,
Logging & integration
Debugging and issue isolation
Application and service configuration
Commerce application
For example, different Commerce versions are compatible with specific versions of PHP, Redis, and so on.
Task scheduling with cron jobs
Message broker for message queue framework
PHP service
Database services
(indexing and optimizing core tables, optimizing default sys-admin settings)
(configuring normalized vs flat tables, indexing and optimizing custom and third party tables, archiving or removing data, configuring system administration settings)
CDN service
Cache Service
Search service
Email service
The service does not support sending of marketing emails.
Third Party services
Commerce Services extensions
Advance Reporting service
Commerce Intelligence
(API, Data quality and formatting, merchant network,
DB connections both inside and outside of Adobe Commerce Cloud DB, over data thresholds)
(Adobe Commerce Cloud database configuration)
Product Recommendations
Network services
Image Optimization
SSL Certificates
Web Application Firewall (WAF)
DDOS
Private Link
(including any VPN connections)