Infrastructure as a Service (IaaS) supplies fundamental computing resources; Platform as a Service (PaaS) supplies an environment for deploying customer applications; and Software as a Service (SaaS) supplies provider-run applications that customers access through a client or program interface.
Under the National Institute of Standards and Technology definition, customers retain progressively less control of the underlying infrastructure from IaaS to PaaS to SaaS. Exact service boundaries vary by offering and contract, so security teams must map responsibilities for identities, data, configuration, code, operating systems, networks, monitoring, recovery, and incident handling rather than rely on the label.
Key points
IaaSThe provider operates physical infrastructure and virtualization, while the customer commonly manages guest systems, applications, identities, data, and much of the virtual-network configuration.
PaaSThe provider also manages the application-hosting platform; the customer controls deployed applications, data, identities, and allowed platform configuration.
SaaSThe provider runs the application and underlying stack; the customer retains responsibilities for users, data, permitted use, available tenant configuration, integrations, endpoints, and contractual requirements.
Important limitationMoving “up” the service stack does not automatically reduce total risk or transfer accountability. Provider failures, unsafe defaults, excessive customer permissions, insecure integrations, data handling, concentration, and unclear contracts can affect every model.