A security team is building one responsibility matrix covering workloads in IaaS, PaaS and SaaS. Which statement should guide how the customer's share is shown across the three models?
Select an answer to reveal the explanation.
Short Explanation
Picture a sliding scale: the more the provider runs for you, the less you manage. IaaS leaves you the most, SaaS the least. But don't fall for the zero trap; your data, your users and your access settings are yours in every model.
Full Explanation
As service models move from IaaS through PaaS to SaaS, the provider takes over more of the stack. In IaaS the customer manages guest operating systems, middleware, applications and data; in PaaS the provider adds the operating system and runtime, leaving applications and configuration to the customer; in SaaS the provider operates the application too. The customer's share therefore shrinks, but it never disappears, because data classification and protection, identity and access management, and the configuration of customer-facing settings stay with the customer in every model. A matrix showing the customer's share growing toward SaaS reverses the relationship; SaaS exposes fewer controllable layers, not more. Showing zero customer responsibility in SaaS ignores account security, access governance and data handling, which are among the most frequent causes of SaaS incidents. Treating the three models identically would misallocate tasks such as operating system patching, which is customer work in IaaS and provider work in PaaS and SaaS. Exam caveat: providers publish their own matrices with small differences, and services within one provider can fall at different points, so map each service, not just each provider. Operational check: list each workload's service model, assign owners for every layer from facilities to data, and confirm that each customer-owned row has a named control and evidence.