A company moves its customer relationship management system from on-premises servers to a SaaS provider. An auditor asks who is responsible for patching the CRM application and its underlying platform. What is the correct answer?
Select an answer to reveal the explanation.
Short Explanation
With SaaS you're renting a fully furnished apartment: the landlord fixes the plumbing and the wiring. You still lock your own door and decide who gets a key. So the provider patches the app and platform, and you keep owning your data, identities and access.
Full Explanation
In the SaaS model defined by NIST SP 800-145, the consumer uses the provider's application running on cloud infrastructure and does not manage the underlying network, servers, operating systems, storage or even individual application capabilities, apart from limited user-specific configuration. Patching the application and the platform beneath it therefore falls to the provider. The customer's share never disappears: it governs its data, the identities and credentials of its users, and how access and sharing settings are configured. A licensing relationship does not transfer patching duty to the customer, because the customer has no access to the application code or servers in SaaS. A split where the customer patches the application while the provider patches the platform describes a PaaS-style arrangement in which the customer deploys its own application, not a provider-supplied SaaS product. A cloud access security broker provides visibility, data protection and policy enforcement for cloud usage; it does not deploy vendor patches into a SaaS application. Exam caveat: each provider publishes its own shared responsibility matrix, so confirm details contractually, but the general division stays the same. Operational check: document the provider's patching commitment from its contract or trust documentation, then verify that the customer's own controls, such as MFA, role assignments and data retention, are configured and reviewed.