Question
A CRM company leverages a CSP PaaS service to host and publish its SaaS product. Recently, a large customer requested that all infrastructure components must meet strict regulatory requirements, including configuration management, patch management, and life-cycle management. Which of the following organizations is responsible for ensuring those regulatory requirements are met?
- A. The CRM company Correct
- B. The CRM company's customer
- C. The CSP
- D. The regulatory body
Explanation
The CRM company is the service provider to its customer and remains accountable for compliance of the SaaS product, even though it delegates some infrastructure operations to the CSP. Under the shared responsibility model, the CRM company must choose a compliant PaaS provider, verify the CSP's attestations and contract terms, and manage the parts it controls. The CSP performs patching of the platform it runs but has no obligation to the CRM company's customer, and neither the customer nor the regulator is responsible for meeting the requirements.
