The "store" phase of the cloud data lifecycle, which typically occurs simultaneously with the "create" phase, or immediately thereafter, is the first phase where security controls can be implemented. In most case, the manner in which the data is stored will be based on its classification.

Explanation
Regardless of which cloud-hosting model is used, the cloud provider always has sole responsibility for the physical environment.

Affected users refers to the percentage of users who would be impacted by a successful exploit.
Scoring ranges from 0, which means no users are impacted, to 10, which means all users are impacted.