What it means
IaaS, PaaS, and SaaS shift responsibility across infrastructure, platforms, applications, identity, configuration, and data. Public, private, hybrid, and community designs create different trust and operational boundaries.
Why it matters
Choosing a model changes which controls the customer must implement and which evidence the provider must supply.
Practical focus
- Map responsibility for every important control
- Evaluate identity, data, network, and logging boundaries
- Understand provider limits and inherited controls
- Review how hybrid connections extend trust
Common mistakes
- Assuming SaaS removes customer security responsibility
- Using model labels without examining the actual contract and architecture
- Ignoring data location and administrative access
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: