Question

A financial services firm migrates its customer relationship management (CRM) system to a fully managed SaaS platform. The provider manages the application, underlying middleware, operating systems, and physical infrastructure. During a security review, the CISO asks which security responsibility the firm itself still cannot delegate to the SaaS provider under the shared responsibility model. Which responsibility remains with the customer?

Accepted Answer

Classifying the data entered into the CRM and managing user access rights

Answer

Patching the operating system that hosts the CRM application

Answer

Maintaining physical security controls at the data center

Answer

Applying security updates to the application runtime and middleware