Private cloud collaboration: who operates and owns each part?

State where infrastructure runs, who owns the account or hardware, who deploys software, and who can administer the service. Identify whether resources are dedicated or logically separated and what isolation evidence is required. List external dependencies such as licensing, update repositories, support access, and optional processing services. Confirm the exact product offer supports the intended architecture. A private network address does not prove that every document operation stays inside the network. Trace data paths and administrative paths separately, because the ability to change configuration or retrieve a backup can matter as much as routine application access.

Use attributable administrator identities and an approved process for exceptional access to document content. Define how supplier access is granted, limited, logged, and revoked. Protect service credentials and encryption keys according to the agreed responsibility model. For releases, require supported versions, change records, staging results, and understood rollback limits. Test restoration with the party that will perform it during an incident, including required metadata and permissions. Review the operating arrangement when staff, suppliers, or account ownership changes. A responsibility model that is never updated can become less accurate than the undocumented practice it was meant to replace.