SaaS applications are becoming an increasingly important component of an organization’s application estate. These applications include key areas such as messaging, CRM, ERP, and many others that are industry specific or often regarded as mission critical. Unfortunately, few organizations fully understand the implications of the “shared responsibility”model inherent in many SaaS applications. Under shared responsibility, the SaaS vendor provides basic data protection and retention. The customer’s responsibility is anything further than the basics, whether for granular data restore, longterm retention, or data governance.