Question

Your company adopts a Software-as-a-Service (SaaS) application to manage customer records. During a security review, a manager asks who is responsible for classifying and protecting the customer data stored in the application. According to the cloud shared responsibility model, who holds this responsibility?

Accepted Answer

The customer (your organization) is always responsible for the data and its classification.

Answer

The cloud provider is responsible because it hosts the underlying infrastructure and application.

Answer

The responsibility is shared equally and neither party can be held accountable for the data.

Answer

The SaaS provider is responsible for data classification but the customer handles physical security.