nShield as a Service is available as either a Self-managed or Fully-managed service. The Self-Managed service means the organization retains the full management of the HSM albeit remotely. The Fully-Managed service suits customers who want to utilize the cryptographic services of an HSM but want to delegate the management and maintenance to a Security Officer role fulfilled by trusted Entrust personnel. Figure 1 below is a modified version of the popular shared responsibility model, used to illustrate the cloud security framework identifying the responsibilities of cloud service provider and customer to highlight accountability. Column 1 represents an on premises deployment. The HSM, HSM management layer and keys are highlighted as icons. In this scenario all of the attributes of an on premises deployment are the responsibility of the customer. Column 2 in the model represents an Infrastructure as a Service (IaaS) deployment where nShield as a Service based on a Self-Managed deployment is the best fit. The HSM in this scenario is the responsibility of Entrust. The management of the HSM and the keys are the responsibility of the customer. Column 3 represents a Platform as a Service (PaaS) deployment where nShield as a Service based on a Fully-Managed deployment is the best fit for the model. In this scenario the HSM and management of the HSM appliance are the responsibility of Entrust. The keys are the responsibility of the customer.