A company moves its document management to a SaaS application. During a design review, a project lead argues that because the provider now runs the application, the provider is accountable for deciding how the company's documents are classified. Who retains that accountability?
Select an answer to reveal the explanation.
Short Explanation
Renting a storage unit doesn't make the landlord decide which boxes hold your valuables. You still own the contents and you decide how they're labeled. The trap is assuming that handing over operations hands over accountability; in the cloud it never does.
Full Explanation
Shared responsibility divides operational duties between provider and customer according to the service model, but accountability for data never transfers. In SaaS the provider operates the infrastructure, platform and application, while the cloud service customer remains the data owner, decides how its information is classified, and configures who may access it. Classification reflects business value, legal obligations and sensitivity, which only the data owner can judge. Claiming that SaaS transfers data governance confuses operating an application with owning the information inside it; the provider processes the data on the customer's behalf. Splitting accountability by SLA percentages misreads what an SLA does: it sets service levels and remedies, not ownership of the customer's data decisions. A broker, if present, intermediates services and contracts but does not acquire ownership of the customer's information or its classification decisions. Exam caveat: contracts can assign specific tasks, such as applying labels or retention settings, to a provider, yet the customer remains answerable to regulators and data subjects for the outcome. Operational check: confirm the customer's data classification policy names an internal data owner for the SaaS repository and that the application's labeling settings reflect that policy.