Skip to content

Strategic Business Leader · Cloud, mobile and smart technology

IaaS, PaaS and SaaS Cloud Models for SBL

Updated 11 October 2026 · Fact-checked

Cloud computing means renting IT resources over the internet instead of owning them. The service models differ in what the provider manages: IaaS gives infrastructure, PaaS adds a platform to build on, and SaaS delivers finished software. Deployment can be public, private or hybrid. You choose by matching control, cost, security and need to the scenario.

Understand Cloud Computing Models: IaaS, PaaS and SaaS

Cloud computing lets an organisation use computing power, storage and software that sit in a provider's data centres. It reaches them over the internet and is usually paid for on a usage or subscription basis. The organisation does not buy and run the servers itself.

The three service models differ in how much the provider manages for you.

  • IaaS (Infrastructure as a Service): the provider supplies servers, storage and networking. You install and manage the operating system, applications and data. You get the most control and carry the most responsibility.
  • PaaS (Platform as a Service): the provider also manages the operating system and runtime tools. You build, test and run your own applications on it. It suits developers who do not want to manage servers.
  • SaaS (Software as a Service): the provider runs the whole application and you simply use it, often through a browser. Examples are online email or accounting packages. You get the least control and the least effort.

The deployment models describe who the cloud is for and where it sits.

  • Public cloud: services are shared by many customers and owned by a provider. It is cheap and scalable, but you have less control over security and location of data.
  • Private cloud: the cloud is used by one organisation only. It may be hosted on its own premises or by a third party. It gives more control and security, but costs more and is less flexible.
  • Hybrid cloud: a mix of the two, with sensitive or core workloads kept private and variable or less sensitive workloads in the public cloud.

In SBL you are rarely asked to define these terms alone. You are asked to advise a business. So link the model to the scenario: its size, its data sensitivity, its IT skills, its growth plans and its regulatory duties. Remember that moving to the cloud moves cost from capital spending to operating spending, but it does not remove the board's responsibility for risk, data and governance.

Key rules to remember

Service model control spectrum
IaaS (most control) → PaaS → SaaS (least control)
The further right, the more the provider manages and the less the customer manages.
What you manage under IaaS
Customer: operating system + applications + data. Provider: servers, storage, networking
Customer still handles patching, configuration and access to the operating system.
What you manage under PaaS
Customer: applications + data. Provider: everything beneath, including operating system
Good for building bespoke applications without server administration.
What you manage under SaaS
Customer: use of the software, user access and own data. Provider: everything else
Fastest to start, but least customisable.
Deployment models
Public (shared) | Private (single organisation) | Hybrid (public + private combined)
Choose by data sensitivity, control, cost and flexibility needs.

How to solve Cloud Computing Models: IaaS, PaaS and SaaS questions

Use this method for any cloud question that asks you to explain, recommend or evaluate.

  1. 1Read the requirement and note the verb: explain, recommend, evaluate or advise. It decides how much you describe and how much you judge.
  2. 2Pick out scenario facts: size, in-house IT skills, data sensitivity, regulation, growth, peaks in demand and budget.
  3. 3Define the relevant model or models in one sentence each, stating what the provider manages and what the customer manages.
  4. 4Apply each model to the scenario facts. Say why it fits or does not fit, using control, cost, scalability, security and speed.
  5. 5Weigh benefits against risks, such as supplier dependence, data location, availability and loss of control.
  6. 6Reach a clear recommendation and say what safeguards are needed, such as contract terms, backup, access controls and monitoring.
  7. 7Write in the format requested, for example a report or memo, to earn professional skills marks.

Quickest way: Control, Cost, Sensitivity check

When to use it: Use when time is short and you need a justified recommendation fast.

  1. Ask what the business wants to avoid managing. If servers, think IaaS. If servers and platform, think PaaS. If everything, think SaaS.
  2. Ask how sensitive the data is. High sensitivity points to private or hybrid. Low sensitivity points to public.
  3. Ask if demand is uneven or growing. If so, public cloud scalability helps.
  4. Write the recommendation in one sentence, then give two benefits, two risks and one safeguard, each tied to a scenario fact.

Common mistakes in Cloud Computing Models: IaaS, PaaS and SaaS

  • Only giving definitions of IaaS, PaaS and SaaS.

    Students memorise textbook terms and forget SBL tests application.

    Fix: After each definition, add a sentence linking it to a named fact in the scenario.

  • Mixing up service models and deployment models.

    Both are called cloud types and appear together in notes.

    Fix: Remember: service model is what you get (infrastructure, platform, software). Deployment model is who shares it and where it sits (public, private, hybrid).

  • Saying the cloud is always cheaper.

    Students focus on lower upfront cost.

    Fix: Say cost shifts from capital to operating spending. Subscriptions, data transfer and migration can add up over time, so compare total cost.

  • Assuming moving to the cloud passes all risk to the provider.

    Students think outsourcing the technology outsources responsibility.

    Fix: State that the board stays accountable for data, compliance and continuity. The provider handles only part of the security.

  • Recommending public cloud for everything without checking data sensitivity.

    Public cloud is the most familiar and cheapest option.

    Fix: Check for regulated or confidential data first. If present, consider private or hybrid and explain why.

  • Giving a long list of generic cloud benefits.

    Students try to cover every point they remember.

    Fix: Pick the three or four benefits and risks that match the scenario and develop each one.

Worked examples

Example 1

Zenith Retail is a mid-sized chain with a small IT team and no developers. It wants to replace its ageing payroll and HR system quickly. It has no wish to manage servers or software updates. Advise which cloud service model suits it and why.

Show the solution
  1. Identify the need: a ready-made HR and payroll application, with minimal IT effort.
  2. Consider IaaS: the company would still manage the operating system and the application. With a small IT team this is too heavy a burden, so it fits poorly.
  3. Consider PaaS: this is for building bespoke applications. Zenith has no developers, so it also fits poorly.
  4. Consider SaaS: the provider runs the whole application and applies updates. Zenith needs only to manage user access and its own data. This matches its limited skills and need for speed.
  5. Note the risks: less customisation, dependence on the provider and the need to protect employee data, so contract terms on data protection and availability are needed.

Answer: SaaS is the best fit because Zenith wants finished software without managing servers or updates. IaaS and PaaS need technical skills it lacks. Zenith should secure a contract covering data protection, availability and exit terms.

Example 2

Harbour Bank is a regulated bank. It holds confidential customer data and is planning to launch a new mobile marketing campaign that will cause large but short-lived peaks in demand. Evaluate whether it should use public, private or hybrid cloud.

Show the solution
  1. Identify the two competing needs: strict protection of confidential customer data, and flexible capacity for temporary peaks.
  2. Assess public cloud: it scales well and costs little at peaks. But shared infrastructure gives the bank less control over data location and security, which is a concern for regulated customer data.
  3. Assess private cloud: it gives strong control and helps with regulatory compliance. But it is costly, and the bank would pay for spare capacity to cover peaks that last only a short time.
  4. Assess hybrid cloud: the bank can keep confidential customer data and core systems in the private cloud and run the campaign workload in the public cloud, using only non-sensitive data.
  5. Add safeguards: encryption, strict access controls, careful design of what data crosses between clouds, and monitoring of the provider.
  6. Conclude with a recommendation.

Answer: A hybrid cloud is best. Core systems and confidential customer data stay in a private cloud for control and compliance, while the campaign uses public cloud for cost-effective scalability. The bank must still manage integration, data movement and provider risks.

Exam tips

  • Always tie the model to scenario facts such as IT skills, data sensitivity and demand pattern. Generic answers score poorly.
  • Show balance. Give benefits and risks, then a clear recommendation. Examiners reward judgement.
  • Use the requested format, for example a short report to the board, and keep a professional tone to earn skills marks.
  • Mention governance: the board remains accountable, so refer to contracts, service levels, exit plans and monitoring of the provider.
  • Link cloud to wider issues in the case, such as cost structure, flexibility, cyber risk and data protection, but stay on the requirement.

Practice questions from Cloud, mobile and smart technology

Cloud Computing Models: IaaS, PaaS and SaaS in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Cloud Computing Models: IaaS, PaaS and SaaS: frequently asked questions

What is the difference between IaaS, PaaS and SaaS?

They differ in how much the provider manages. IaaS supplies infrastructure, PaaS adds a platform for building applications, and SaaS provides complete software. Control for the customer falls as you move from IaaS to SaaS.

What is the difference between public, private and hybrid cloud?

Public cloud is shared by many customers and run by a provider. Private cloud is used by one organisation only. Hybrid cloud combines both so that workloads can sit where they fit best.

Do I need technical detail on cloud for SBL?

No. You need a clear grasp of the models and the business impact. The exam tests whether you can advise on cost, risk, control and strategy using the scenario.

How should I structure a cloud recommendation in the exam?

Define the option briefly, apply it to the scenario, weigh benefits and risks, then recommend with safeguards. Keep each point linked to a fact in the case.