An organization is deploying their servers to the cloud using the infrastructure as a service model. In the shared responsibility model, what is the cloud provider responsible for?

Data access policies are the customer's responsibility in IaaS because the customer controls the operating system, application, and identity configuration.

Operating system security is the customer's responsibility in IaaS, since the customer provisions and manages the OS on the virtual machine.

Software security is the customer's responsibility in IaaS, as the customer installs, configures, and patches all software running on the VM.

In the IaaS model, the cloud provider is responsible for the physical security of data centers, hardware, and networking infrastructure. The customer takes responsibility for everything above the hypervisor layer, including the operating system, applications, and data.