IaaS vs PaaS vs SaaS Shared Responsibility
The more the provider manages, the less infrastructure the customer operates directly.
IaaS
The provider manages core infrastructure while the customer manages more of the operating system, applications, data, and configuration.
PaaS
The provider manages more of the platform stack while the customer focuses more on applications, data, and configuration.
SaaS
The provider manages most of the application stack, while the customer still retains responsibilities such as identities, access, data governance, and configuration.
Exam strategy
Do not assume cloud means the customer has no security responsibility.
The takeaway
Shared responsibility shifts by service model, but customer responsibilities never disappear entirely.
Related Summit resources
FAQ
What is the core idea?
Shared responsibility shifts by service model, but customer responsibilities never disappear entirely.
What should you identify first?
The more the provider manages, the less infrastructure the customer operates directly.
Why does this matter on the CPA Exam?
Understand how security responsibility shifts across cloud service models.