Question

A retail company is adopting a SaaS-based human resources platform. During a security review, the CISO asks the cloud security architect to define which layers the organization itself must secure under the shared responsibility model. Which set of responsibilities remains with the customer in a typical SaaS arrangement?

Accepted Answer

User access management, data classification, and configuration of application-level security settings

Answer

Patching the underlying operating system and managing hypervisor hardening

Answer

Maintaining physical data center controls and network fabric segmentation

Answer

Applying security patches to the application runtime and middleware components