No single party can independently control every security risk. Security depends on the complete deployment environment, including customer networks, account management, third-party interfaces, access permissions and operational practices. Responsibilities should be defined according to the agreed project scope.