A company moves all corporate email to a SaaS provider. The CIO tells the board that security is now entirely the provider's job. Which responsibility does the company still clearly retain under the shared responsibility model?
Select an answer to reveal the explanation.
Short Explanation
Moving into a serviced office means someone else fixes the lights and the elevator, but you still decide who gets a badge and what's in your filing cabinets. In SaaS you keep identities, access and your data. The trap is the CIO's line: nothing moves your accountability to the provider.
Full Explanation
In SaaS the provider operates the infrastructure, platform and application, including servers, operating systems, application code, hypervisors and data centers. The customer still owns several things in every service model: its data, the classification and handling of that data, user identities, and the access configuration within the tenancy, such as who is an administrator, whether multifactor authentication is enforced, and which sharing and forwarding settings apply. Many SaaS breaches stem from exactly these customer-side areas, such as compromised accounts or overly permissive sharing. Patching mail server operating systems and application code is the provider's operational duty in SaaS; the customer cannot reach those layers. Physical and environmental security of data centers belongs to the provider in every public cloud model. Hypervisor hardening and tenant isolation are provider controls the customer verifies through attestations but cannot perform. Exam caveat: the CIO's statement is the classic misconception; accountability, including to regulators and data subjects, stays with the customer. Operational check: review the tenant's security settings against a baseline, including multifactor authentication enforcement, administrator role assignments, external forwarding rules, audit logging and retention, and confirm data owners are named for the mailboxes.