A company moves its database servers to a cloud provider's IaaS offering. During an audit, the question arises: who must apply security patches to the guest operating systems running on those virtual machines?