ITPEC FE Subject A April 2025 Question 29

No system construction, so no development security requirements or log storage design — with SaaS the provider builds and runs the application and the user subscribes to it.

SaaS delivers finished application software over the network. The user does not develop or build the system, so tasks that belong to construction, such as defining security requirements for application development or sizing the storage for system logs, fall to the provider.

What stays with the user is using the service securely: managing its own user accounts and passwords, planning what to do during an outage, keeping copies of its data, and running its own security management.

Answer (b)

Why not others:

• •(a) — user access management remains the customer's job: issuing and removing accounts, password resets and a password policy for its own users
• •(c) — the provider operates the servers, but the user still needs procedures for when the service fails and a plan for backing up its own data
• •(d) — accountability for security cannot be outsourced: the organisation still needs information security rules and a person in charge of the service

Key rule: Cloud models split responsibility; SaaS takes away building and operating the system, never the customer's own accounts, data and security management.

Security · AI-written, may contain errors