Question

An organization is migrating its email and collaboration workloads to a SaaS platform (Microsoft 365). During a security review, the CISO asks which security responsibilities remain with the customer under the SaaS shared responsibility model. Which task is the customer solely responsible for in this deployment?

Accepted Answer

Classifying data and managing user access permissions to that data

Answer

Patching the underlying operating system that hosts the SaaS application

Answer

Maintaining the physical security of the provider's data centers

Answer

Patching and hardening the application runtime and middleware