The statement is false. Security in the cloud is typically a shared responsibility between the cloud provider and the cloud consumer. While the cloud consumer is indeed responsible for implementing security controls related to their data and applications, the cloud provider is responsible for securing the infrastructure, including the physical security of the data centers and the underlying hardware.