The cloud service delivery model that best suits the need for the IT department to patch and update cloud resources properly is IaaS (Infrastructure as a Service). In an IaaS model, the consumer is responsible for managing and maintaining the operating systems, applications, and patches on the virtual machines and resources provided by the cloud service. This level of control allows the IT department to directly handle the compliance requirements set by the cloud consumer compliance team.
The SaaS provider specifying in the user agreement that the customer will be responsible for any misuse of the service is an example of risk transference. In this context, transference means shifting the responsibility or burden of risk to another party, in this case, the customer. The provider is transferring the potential risk and consequences of misuse away from itself to the customer.