In SaaS, who is responsible for security and most maintenance?

In SaaS, who is responsible for security and most maintenance?

• A. Provider handles nearly everything including security.
• B. Customer handles security.
• C. Both share equally.
• D. Neither.

Answer: (A)

In SaaS, the service provider runs and secures the entire software stack and underlying infrastructure. They handle the heavy lifting of maintenance—patching the application, updating components, managing backups and disaster recovery, monitoring security, and keeping the platform up and running. Your role as the customer is primarily to manage your data and how people access it, including configuring user accounts, permissions, and authentication policies, and ensuring you classify and protect sensitive information within the app. So the provider handling nearly everything including security is the best fit because the service is delivered as a managed solution where the vendor maintains the application and its security controls, while you focus on data governance and access. The other options don’t fit because they imply the customer bears the bulk of security and maintenance duties, or that neither side is responsible, which isn’t how SaaS typically operates.

In SaaS, the service provider runs and secures the entire software stack and underlying infrastructure. They handle the heavy lifting of maintenance—patching the application, updating components, managing backups and disaster recovery, monitoring security, and keeping the platform up and running. Your role as the customer is primarily to manage your data and how people access it, including configuring user accounts, permissions, and authentication policies, and ensuring you classify and protect sensitive information within the app.

So the provider handling nearly everything including security is the best fit because the service is delivered as a managed solution where the vendor maintains the application and its security controls, while you focus on data governance and access. The other options don’t fit because they imply the customer bears the bulk of security and maintenance duties, or that neither side is responsible, which isn’t how SaaS typically operates.