Who is responsible for ensuring compliance when an organization uses a cloud provider to host...

An independent auditor employed by the cloud provider is responsible for ensuring compliance.

The cyber insurance carrier is responsible for ensuring compliance.

The cloud provider may have a level of responsibility; however, the customer is ultimately responsible for ensuring compliance.

Compliance is equally shared between the cloud provider, the customer, and third-party vendors that interact with the VM instances.