ISC Cloud Computing · Updated November 2026
IaaS, PaaS, or SaaS: Who Manages What?
Cloud models represent different levels of outsourcing. Security responsibility shifts but does not disappear.
IaaS
The provider supplies underlying infrastructure while the customer retains more responsibility for operating systems, applications, configurations, and data depending on the service.
PaaS
The provider manages more of the underlying platform while the customer focuses more on applications and data.
SaaS
The provider operates the application itself, but the customer still owns responsibilities such as user access, configuration, data handling, and appropriate use.
Shared responsibility
Moving to cloud does not mean the vendor handles all security.
The takeaway
IaaS gives the customer more control and responsibility. SaaS outsources more of the technology stack.
Related Summit guides
FAQ
Does SaaS eliminate customer security responsibilities?
No.
Does IaaS generally give the customer more control?
Yes.
Is PaaS conceptually between IaaS and SaaS?
Yes.