Core Cloud Models (The “Big Three”)
These are the foundational service models defined by NIST and used by AWS, Azure, and Google Cloud.
| Acronym | Name | Description |
|---|---|---|
| SaaS | Software as a Service | Complete applications delivered over the internet. No server or infrastructure management required by users. Examples: Gmail, Microsoft 365, Salesforce |
| PaaS | Platform as a Service | A platform for developers to build and deploy applications without managing the underlying infrastructure. Examples: Azure App Services, Google App Engine, Heroku |
| IaaS | Infrastructure as a Service | Virtualized computing resources over the internet — the most flexible layer. Examples: AWS EC2, Azure VMs, Google Compute Engine |
These three models reflect how much control vs convenience you’re trading off from full control in IaaS to full convenience in SaaS.
See: Shared Responsibility Model
🛠️ Developer, SysAdmin, and DevOps-Oriented Models
These models often build on IaaS/PaaS and are vital for modern app deployment, automation, and DevOps.
| Acronym | Name | Purpose |
|---|---|---|
| CaaS | Container as a Service | Containerized app delivery with orchestration built in (usually Kubernetes). |
| FaaS | Function as a Service | Serverless model for running individual code functions on demand. |
| DBaaS | Database as a Service | Managed databases, backups, scaling, and patching done for you. |
| BaaS | Backend as a Service | Mobile/web backend functions like auth, storage, and APIs prebuilt. |
🔐 Security as a Service Models
Security services are increasingly consumed as cloud-delivered, subscription-based services. Common in MSP and enterprise environments.
| Acronym | Name | Description |
|---|---|---|
| SECaaS | Security as a Service | Cloud-based antivirus, anti-malware, firewall, and policy enforcement. |
| SOCaaS | SOC as a Service | Outsourced threat monitoring and incident response, often using MDR/XDR. |
| IDaaS | Identity as a Service | Cloud IAM systems (e.g., Okta, Azure AD). |
| PAMaaS | Privileged Access Management as a Service | Secure control of admin/root access across environments. |
🖥️ Business and User Services
These models are used for end-user access, communication, and collaboration — and often form the MSP service stack.
| Acronym | Name | Also Known As | Description |
|---|---|---|---|
| DaaS | Desktop as a Service | Virtual Desktop Infrastructure (VDI), Cloud PC | Virtual desktop environments streamed to users. |
| UCaaS | Unified Communications as a Service | Cloud PBX, VoIP | Voice/video/chat platforms, typically replacing PBX systems. |
| CCaaS | Contact Center as a Service | Cloud Call Center | Cloud-based call/contact center solutions. |
| ITaaS | IT as a Service | Managed Service Provider (MSP), Outsourced IT, vCIO, Co-managed IT | Full-service outsourced or co-managed IT support, typically delivered by MSPs. |
🧪 Emerging and Niche Models
These aren’t always standard, but you’ll see them in niche solutions, startups, or advanced IT labs:
| Acronym | Name | Description |
|---|---|---|
| XaaS | Everything/Anything as a Service | Umbrella term for any “as a Service” delivery model. |
| STaaS | Storage as a Service | Pay-as-you-go cloud storage (e.g., S3, Azure Blob). |
| NaaS | Network as a Service | Virtualized networking (firewalls, SD-WAN, cloud VPNs). |
| AaaS | Analytics/AI as a Service | ML models or analytics tools hosted and consumed via API. |
| RaaS | Ransomware/Robotics as a Service | Dark web criminal model or industrial automation context (depends on source). |