“I always want to point out this is a shared responsibility model. You have to holistically show your compliance. If a hybrid or onprem environment you used to own 100% of controls”