A retailer moves its application to IaaS virtual machines. The provider manages the physical hosts. Who normally remains responsible for patching the guest operating systems?

1. The independent auditor reviewing the service
2. The provider because it owns the hardware
3. The retailer operating the virtual machines
4. The network carrier supplying connectivity