Question

A company adopts a SaaS-based customer relationship management (CRM) platform hosted by a third-party vendor. During a security review, the cloud architect must clarify which responsibilities remain with the company versus the SaaS provider. Which task remains the company's responsibility under the SaaS shared responsibility model?

Accepted Answer

Managing user access permissions and classifying the data entered into the CRM

Answer

Patching the underlying operating system that runs the CRM application

Answer

Maintaining the physical security of the data center hosting the application

Answer

Applying updates to the CRM application code and its runtime dependencies