A mayor asks who is responsible if a SaaS HR system is misconfigured to expose employee records. Which answer aligns with shared responsibility?
Select an answer to reveal the explanation.
Short Explanation
SaaS means someone else runs the app plumbing, but the city still decides who sees the employee files. Mis-clicked sharing and weak access choices stay on the customer side. The provider does not become the HR records owner.
Full Explanation
Under shared responsibility for software as a service, the provider manages the application and much of the underlying infrastructure. Customers still control data classification, identity lifecycle, and access permissions. A misconfiguration that exposes HR records is typically a customer-side access and configuration failure, not proof that SaaS removes customer duty.