This is false, because, unless, specified cloud customer is legally liable for any loss to data

lS0 27005 'provides guidelines for information security risk management' and 'supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach.'

The Cloud Security Alliance STAR Registry is an assurance program and documentation registry or cloud provider assessments based on the CSA Cloud Controls Matrix and Consensus Assessments Initiative Questionnaire. Some providers also disclose documentation for additional certifications and assessments(including self-assessments).
Ref: Security Guidance v4.0 Copyright2017, Cloud Security Alliance(used for educational purpose here)

SaaS requires least maintenance from the customer as all the infrastructure up to application is managed by the cloud service provider