An online retailer has decided to store its customer database with a cloud provider in an Infrastructure as a Service (laaS) configuration. During an initial review of preliminary risk scenarios, a risk practitioner identifies instances where sensitive customer information is stored unencrypted. Who is accountable for ensuring this encryption?