Your company is migrating its email and collaboration platform to a Software as a Service (SaaS) offering. During a security review, a stakeholder asks which responsibility will always remain with your organization regardless of the cloud service type used. Which responsibility is correct?