Technology
IaaS, PaaS, SaaS: cloud service models for public agencies
What each cloud service model means, who is responsible for what, and how agencies typically use them.
Cloud services are sold in three broad models. The differences determine cost, flexibility, and, most importantly for public agencies, who is responsible for security and operations.
Infrastructure as a service
The provider supplies virtual machines, storage, and networking. The agency installs and manages operating systems, applications, and data. Maximum flexibility, maximum responsibility. Suited to lifting existing applications into the cloud with minimal change.
Platform as a service
The provider supplies managed runtimes and services: databases, application hosting, queues, and analytics engines. The agency deploys code and data; the provider patches and scales the platform. Less operational burden, some constraints on how applications are built. Suited to new development and modernized applications.
Software as a service
The provider runs a complete application, and the agency uses it through a browser or API. Minimal operational burden, minimal control. The agency's responsibilities narrow to configuration, user management, and data. Suited to commodity functions: email, collaboration, HR, and many line-of-business systems.
Responsibility shifts
In every model, the agency remains responsible for its data, its users, and its configuration. The shared responsibility model for each service should be documented.
Authorization programs
StateRAMP and FedRAMP provide standardized assessments of cloud services' security controls. An authorized service has been assessed against a defined baseline; agencies should still verify that the authorization covers the specific service and impact level they need.
Procurement considerations
SaaS is a subscription, often procured as a service rather than software. Data ownership, export rights, and exit terms matter more than with software the agency installs. Consumption-based infrastructure and platform services require budget controls because costs vary with use.
Typical agency mix
Most agencies end up with SaaS for commodity functions, platform services for applications they build, and infrastructure for legacy systems awaiting modernization. The mix shifts toward higher-level services over time.