(ISC)2 Certified in Cybersecurity Practice Exam

In a SaaS platform, who is responsible for the data maintained?

1. Vendor

2. Customer

3. Both vendor and customer

4. Neither

The correct answer is: Customer

In a Software as a Service (SaaS) model, the customer is primarily responsible for the data they maintain on the platform. This responsibility encompasses data input, management, and compliance with relevant regulations or policies. When customers subscribe to a SaaS offering, they often supply their data to the vendor’s platform for processing, storage, or analysis. While the vendor is responsible for the security, availability, and maintenance of the SaaS environment, it is the customer who determines what data is uploaded, how it is used, and who has access to it. This includes ensuring that any sensitive information complies with data protection regulations, such as GDPR or HIPAA, which place accountability on the data owner—the customer—rather than the service provider. In contrast, there are shared responsibilities where both the vendor and customer contribute to security practices, but the ultimate ownership of the data rests with the customer. This concept is fundamental in understanding cloud service models and their implications for data governance and security.