What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

The correct answer is A. Access controls. In the SaaS shared responsibility model, the cloud provider owns and controls the infrastructure, operating systems, middleware, application code, patching, vulnerability management, and source code - the customer has no access or control over these layers. The customer's…

Cloud Auditing for Infrastructure, Platform, and Software as a Service (IaaS, PaaS, SaaS)

Question

Options

AAccess controls
BVulnerability management
CSource code reviews
DPatching

How the community answered

(20 responses)

A
95% (19)
C
5% (1)

Explanation

In the SaaS shared responsibility model, the cloud provider owns and controls the infrastructure, operating systems, middleware, application code, patching, vulnerability management, and source code - the customer has no access or control over these layers. The customer's primary responsibility is managing who has access to the SaaS application and what they can do within it (access controls: user provisioning, roles, permissions, authentication policies, and offboarding). This is what auditors should focus on when reviewing a customer's SaaS environment, since it is the one domain entirely within the customer's control.

Topics

#SaaS Security#Shared Responsibility Model#Access Management#Cloud Auditing

Community Discussion

No community discussion yet for this question.

Full CCAK Practice