Patching responsibility is a component of which program?

• A. Cloud vendor assessment program
• B. Asset management program
• C. Incident response plan
• D. Data classification program

Answer: (A)

Patching responsibility is evaluated within the cloud vendor assessment program because it focuses on how the cloud provider manages security controls and who is responsible for applying patches. When you assess a cloud vendor, you look for clear policies and practices around patch management, including ownership, patch timelines, testing, and communication, to ensure vulnerabilities are remediated promptly and responsibilities are defined between the provider and customer.

Asset management, incident response, and data classification address different areas: asset management tracks what you own, incident response covers how you react to security events, and data classification governs how data is labeled and handled. They don’t center on the vendor’s patching practices in the way a vendor assessment does.