NIST SP 800-145 NISTSP145-5: Service Model Classification (SaaS, PaaS, IaaS)

Classify each cloud service the organisation consumes against the three service models defined in NIST SP 800-145 Section 3: Software as a Service (SaaS) where the consumer uses the provider's applications running on a cloud infrastructure, accessible from various client devices through either a thin client interface such as a web browser, or a program interface, and the consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities with the possible exception of limited user-specific application configuration settings; Platform as a Service (PaaS) where the consumer deploys onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider, and the consumer does not manage or control the underlying cloud infrastructure but has control over the deployed applications and possibly configuration settings for the application-hosting environment; Infrastructure as a Service (IaaS) where the consumer provisions processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software which can include operating systems and applications, the consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications, and possibly limited control of select networking components such as host firewalls. Classification drives the shared responsibility split and the control inheritance evidence the provider must furnish.