Infrastructure as a Service (IaaS)

Infrastructure as a Service (IaaS) is a cloud delivery model where the provider supplies virtualized computing resources — servers, storage, and networking — over the internet. You rent the infrastructure instead of buying and maintaining physical hardware, but you manage everything running on it: operating systems, applications, data, and security configurations.

Popular IaaS providers include AWS, Microsoft Azure, and Google Cloud. With IaaS, you have more control but also more security responsibility than with SaaS. You must secure everything from the operating system up, including patching, hardening, access controls, and monitoring.

Why It Matters

If you use IaaS to host CUI workloads, your security responsibilities are significant. The cloud provider secures the physical infrastructure, but you are responsible for everything else — and CMMC assessors will evaluate your cloud security just as they would an on-premises environment.