No or only limited control, but still responsible and having to deal with potential adverse consequences. You can't just trust the security measures of your SaaS supplier. So, what should you do?