A national charity adopts a public SaaS customer-relationship platform to hold donor records classified as personal data. The provider controls the application, the operating system and the infrastructure. Leadership asks the security lead which safeguard the charity can still directly implement to reduce the risk of unauthorised access to donor records. Which measure is within the customer's control in this SaaS model?
- ARewriting the application's authentication module to enforce stronger password hashing algorithms
- BConfiguring user access, roles and multi-factor authentication within the platform's administration settings Correct
- CApplying security patches to the operating system that runs beneath the SaaS application
- DSegmenting the provider's internal network to isolate the multi-tenant database from other tenants
Why A is wrong: The SaaS provider owns the application code, so the customer cannot rewrite its authentication module; this control sits beyond the customer boundary.
Why B is correct: Identity and access management, including role assignment and MFA configuration, is exposed to the SaaS tenant as an administrative control, making it the customer's most direct lever over access risk.
Why C is wrong: OS patching is the provider's responsibility in SaaS; the customer has no access to the underlying operating system, so it cannot own this task.
Why D is wrong: Tenant isolation and internal network segmentation are architected and operated by the provider in SaaS, so this is outside the charity's control despite sounding protective.