A small clinic is moving its health and accounting systems to a SaaS solution. The clinic holds patient- and business-sensitive information. Which of the following is the company expected to do to…

While documenting, configuring, and enforcing strong account management policies is crucial, it primarily addresses authentication and authorization, not directly the network-level hardening of the server itself.

Even in a SaaS environment, if the customer has configuration access to a dedicated instance or tenant-specific network settings that expose certain ports, disabling unused ones reduces the attack surface. This action limits potential entry points for unauthorized access and helps protect sensitive patient and business information by ensuring only necessary communication channels are open.

Installing antivirus and disabling unneeded services on SaaS servers are typically responsibilities of the SaaS provider, not the customer, under a standard shared responsibility model.

Hardening the underlying infrastructure, including servers, firewalls, and load balancers, is exclusively the responsibility of the SaaS provider in a shared responsibility model.