Question

A marketing team at a retail company adopts a fully managed SaaS email campaign platform. During a security review, the IT director asks which security responsibilities remain with the company rather than being handled by the SaaS vendor. What is the company's primary remaining responsibility under the shared responsibility model for SaaS?

Accepted Answer

Managing user access, credentials, and how their own data is classified and shared

Answer

Patching the underlying operating system that runs the SaaS application

Answer

Configuring and maintaining the physical network hardware in the data center

Answer

Applying updates to the SaaS application's runtime and middleware components