A finance company is moving sensitive data to the cloud. Under the Shared Responsibility Model, which security task is primarily the customer's responsibility regardless of IaaS, PaaS, or SaaS?

Data classification and encryption is always the customer's responsibility. Regardless of the cloud service model (IaaS, PaaS, or SaaS), the customer owns their data and is accountable for classifying it appropriately and implementing encryption to protect its confidentiality and integrity. Physical security of the data center is always the cloud provider's responsibility. Security of the host operating system and management of the virtualization layer are generally the cloud provider's responsibility in PaaS and SaaS models, and shared in IaaS, but never solely the customer's across all models.