A SaaS application exposes only a limited set of audit logs to customers, omitting file-level access events that the company needs for compliance reporting. What is the best course of action?
Select an answer to reveal the explanation.
Short Explanation
In SaaS you don't own the servers, so you can't bolt your own logging onto them. You push the provider for more through the contract, and you fill gaps with logs you do control, like your identity provider and CASB. And no, the accountability never moves to the provider.
Full Explanation
Available event sources vary by service model. In IaaS, customers can log at the operating system, application and network layers they control; in PaaS, less; and in SaaS, customers typically see only the logs the provider chooses to expose. When those logs are insufficient for compliance, the customer should address the gap contractually, negotiating access to the needed event types, export mechanisms, retention and format, and supplement provider logs with sources it does control, such as identity provider sign-in records and CASB activity logs that capture user interactions with the application. Installing logging agents on the provider's servers is not possible; the customer has no administrative access to SaaS infrastructure. Accepting the gap on the grounds that accountability transfers to the provider misreads shared responsibility; the customer remains accountable for its compliance obligations even when the provider performs operations. Packet captures on the provider's network are likewise outside the customer's control and would not be permitted, and encrypted traffic would yield little anyway. Exam caveat: logging requirements should be evaluated before selecting a SaaS provider, not after. Operational check: map each required audit event to a log source and confirm every one is collected in the SIEM.