Danzell 2026
Danzell Cloud Services Rules: IaaS, PaaS and SaaS
Published 2 July 2026
The three cloud models
- IaaS (e.g. AWS EC2, Azure VMs) – you patch the OS, configure firewalls and manage user access on the instance.
- PaaS (e.g. Azure App Service, AWS Lambda, Google App Engine) – the provider patches the runtime, you secure the app config, secrets and identities.
- SaaS (e.g. Microsoft 365, Salesforce, Xero) – the provider runs everything, you configure tenants, MFA and user lifecycle.
Your responsibilities under Danzell
| Control | IaaS | PaaS | SaaS |
|---|---|---|---|
| Boundary firewall | You | You (network rules) | Provider |
| Secure configuration | You | You (app + service) | You (tenant config) |
| User access control + MFA | You | You | You |
| Malware protection | You | Shared | Provider |
| Security update management | You | Provider (runtime) | Provider |
Evidence assessors expect
- List of in-scope cloud services with the service model declared.
- Admin console screenshots showing MFA enforced.
- For IaaS: patching cadence and image hardening evidence.
- For PaaS: secrets management approach (Key Vault, Secrets Manager).
- For SaaS: tenant security baseline (Secure Score for M365, Salesforce Health Check).
Common gaps
- Shadow SaaS apps adopted without IT knowledge – inventory them.
- IaaS instances spun up for one-off tests and never patched – tag and lifecycle them.
- Default storage buckets left public – check for any public S3 / Blob.
Combine this with our Danzell MFA guide and the scoping guide for a complete view.