FFIEC IT Examination Handbook AIO-VII.A.2: VII.A.2 Cloud Service Models (Architecture, Infrastructure, and Operations)

Management determines the optimal architecture for an application or service from its requirements for data classification, data residency, availability and external interfaces, and understands what it controls under each service model: applications on provider infrastructure with limited configuration under software as a service, deployed applications and possibly their settings under platform as a service, and operating systems, storage and deployed applications but not the underlying infrastructure under infrastructure as a service.