The division into three service models goes back to a definition by the US National Institute of Standards and Technology (NIST) and is in general use today. It helps answer a central question in every cloud decision: who takes care of which part, who installs updates, and who backs up the data.
How the models differ
- Infrastructure as a Service (IaaS): The provider supplies virtual machines, storage, and networks. The company manages the operating system, middleware, applications, and data itself. Example: a virtual server in Microsoft Azure.
- Platform as a Service (PaaS): The provider also operates the operating system and runtime environment. The company takes care of its own application and its data. Examples are managed databases or platforms for running web applications.
- Software as a Service (SaaS): The finished application is used via a browser or app. The company only manages settings, user accounts, and data. Examples are Microsoft 365, online accounting, or CRM systems.
An everyday comparison: IaaS is like renting an empty workshop, PaaS is like a fully equipped workshop with tools, and SaaS is like hiring a trade business that delivers the finished result.
The higher the model, the more the provider takes over. However, data, identities, and access rights remain the company's responsibility in every model. This principle is called shared responsibility.
Typical examples
- An older line-of-business application needs a specific operating system and therefore runs as IaaS.
- A self-developed customer interface is operated as PaaS so that the company does not have to deal with server maintenance.
- Email, office applications, and time tracking are used as SaaS.
In practice, many companies combine all three models with their own on-premises infrastructure.
What companies should keep in mind
- Clarify responsibility in writing: For each service, record who installs updates, who monitors, and who backs up.
- Check data backup: Even with SaaS, how long deleted data can be restored is not automatically settled, see Backup and Recovery.
- Plan the exit: Check export options and data formats before signing the contract in order to limit dependencies.
- Understand the cost model: IaaS and PaaS are usually billed by consumption, SaaS usually per person or usage unit.
- Clarify data location: Data residency must be set out in the contract for all three models.