| Number of primary cloud service models | 3 (SaaS, PaaS, IaaS) (NIST Special Publication 800-145) |
| Who manages hardware in IaaS | The cloud provider |
| Typical SaaS billing model | Per-user subscription (monthly or annual) |
| Primary PaaS use case | Application development and deployment |
| Defining framework for cloud models | NIST SP 800-145 (U.S. National Institute of Standards and Technology) (NIST Special Publication 800-145) |
| Customer OS responsibility | IaaS only — customer manages OS and above |
The Three-Tier Framework Every Business Should Understand
Cloud computing is not a single product — it is a family of delivery models that differ fundamentally in what the provider manages and what the customer controls. The U.S. National Institute of Standards and Technology (NIST) formally defined three service models in Special Publication 800-145: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Understanding the distinctions helps business leaders make informed procurement decisions, allocate IT responsibility correctly, and avoid mismatched expectations with vendors.
These models are best understood as a stack. IaaS sits at the bottom, closest to physical hardware. PaaS builds on top of that, adding developer tools and runtime environments. SaaS sits at the top — a finished application delivered directly to end users. For a broader look at how cloud fits into overall technology operations, see IT Infrastructure Explained.
| Number of primary cloud service models | 3 (SaaS, PaaS, IaaS) (NIST Special Publication 800-145) |
| Who manages hardware in IaaS | The cloud provider |
| Typical SaaS billing model | Per-user subscription (monthly or annual) |
| Primary PaaS use case | Application development and deployment |
| Defining framework for cloud models | NIST SP 800-145 (U.S. National Institute of Standards and Technology) (NIST Special Publication 800-145) |
| Customer OS responsibility | IaaS only — customer manages OS and above |
IaaS: Renting the Data Center
Infrastructure as a Service gives organizations virtualized computing resources — servers, storage, and networking — delivered over the internet on a pay-as-you-go basis. The provider owns and maintains the physical hardware; the customer is responsible for the operating system, middleware, runtime, applications, and data. This model offers the highest degree of control and customization among the three tiers.
IaaS is well suited to organizations with in-house IT expertise that need flexibility over their environments — for example, companies running custom workloads, legacy applications that require specific OS configurations, or development and testing environments that must scale rapidly. The tradeoff is management overhead: patching, securing, and configuring virtual machines remains the customer's responsibility. For a direct comparison of cloud and traditional on-premises infrastructure, On-Premise vs. Cloud Infrastructure covers cost, control, and scalability considerations in detail.
SaaS (Software as a Service)
A cloud delivery model in which software applications are hosted and maintained by a provider and accessed by users over the internet. The provider manages all underlying infrastructure, updates, and security patches.
PaaS (Platform as a Service)
A cloud environment that supplies developers with the tools, runtime, and middleware needed to build and deploy applications without managing the underlying servers or operating systems.
IaaS (Infrastructure as a Service)
A cloud model that provides virtualized computing resources — servers, storage, and networking — on demand. The customer manages the operating system and everything above it; the provider manages the physical hardware.
Shared Responsibility Model
The division of security and operational duties between a cloud provider and its customer. The exact split varies by service model: IaaS places more responsibility on the customer, SaaS places more on the provider.
Virtualization
Technology that creates simulated versions of computing resources — such as servers or storage — allowing multiple workloads to share the same physical hardware efficiently.
Elasticity
The ability to automatically scale computing resources up or down in response to workload demand, a defining characteristic of cloud infrastructure.
PaaS: A Platform Built for Developers
Platform as a Service abstracts away server management entirely, providing developers with a pre-configured environment — operating system, middleware, runtime libraries, and deployment tools — where they can build, test, and deploy applications without provisioning or maintaining the underlying infrastructure. The provider handles OS updates, security patches, and hardware scaling automatically.
PaaS is typically adopted by software development teams or businesses building proprietary internal tools. It accelerates development cycles by removing infrastructure setup from the workflow. However, customers accept some reduction in environmental control in exchange for that convenience. Organizations should also understand how PaaS decisions interact with software licensing obligations, particularly when third-party components are incorporated into applications built on these platforms.
SaaS: Software Delivered as a Subscription
Software as a Service is the model most business users encounter directly. The provider hosts a complete, functioning application and delivers it via a web browser or thin client. The customer manages nothing beyond application-level configuration and user data. Payroll platforms, customer relationship management systems, and email services are common examples of SaaS products.
SaaS shifts virtually all operational responsibility to the provider, which reduces internal IT burden but also limits customization. Licensing is typically subscription-based — often per user per month — which makes costs predictable but requires attention to contract terms, data portability rights, and service-level agreements. Businesses evaluating IT support models that complement SaaS-heavy environments can explore the options covered in IT Support Models: Break-Fix, Managed Services, and Co-Managed IT.
These Models Can Coexist in One Organization
Most businesses use all three cloud service models simultaneously — SaaS for productivity tools, PaaS for internal development projects, and IaaS for workloads requiring direct infrastructure control. Choosing a model is not a one-time decision but an ongoing alignment between workload requirements and operational capability. Consult your IT strategy and qualified technology advisers when evaluating which model fits specific use cases.
This article provides general educational information about cloud computing service models and is not intended as personalized technology, legal, or financial advice. Business technology decisions involve considerations specific to each organization's size, risk tolerance, and regulatory environment. Consult qualified IT professionals and advisers for guidance tailored to your circumstances.