Justine has been working on the contract between her company, the Cloud Service Customer (CSC), and the Cloud Service Provider (CSP) that they are purchasing a Software as a Service (SaaS) product from. In the shared responsibility model, who is responsible for protecting the application?