NIST SP 800-210 General Access Control Guidance for Cloud Systems 2f: Keep consumer data under consumer control, and flag and report any data the provider can read

What does 2f require?

Regardless of service model the consumer remains responsible for its cloud-based data and for who has access to it, so control of the data stays with the consumer and a provider acting as custodian does not have access to it (log data excepted, with its own privacy and security consideration). Where consumer data is not encrypted and administrators could read it, that data is identified from the provider's access privileges, flagged as accessible by the provider, and the consumer is informed at once.