A small clinic is moving its health and accounting systems to a SaaS solution. The clinic holds patient- and business-sensitive information. Which of the following is the company expected to do to…

Account management is a valid customer responsibility in SaaS, but it addresses identity and access control rather than the direct network-layer hardening needed to protect sensitive data at the connectivity boundary.

Under the SaaS shared responsibility model, the provider owns servers, OS, and core infrastructure, but the customer is still responsible for reducing attack surface within its configurable scope, which includes disabling and documenting unneeded ports and protocols on any network paths it controls connecting to the SaaS platform. For a clinic handling PHI and financial data, this network-layer hardening is a critical compliance obligation. Documenting disabled ports also creates an auditable record required by regulations such as HIPAA.

Installing antivirus and disabling services on SaaS servers is the provider's responsibility - the customer has no access to the underlying server OS in a SaaS model.

Hardening physical servers, firewalls, and load balancers belongs entirely to the SaaS provider; the customer has no administrative access to this infrastructure layer.