An organization is considering partnering with a third-party supplier of cloud services. The organization will only be providing the data and the third-party supplier will be providing the security co

Platform as a Service (PaaS) requires the customer to manage their own applications and data security, meaning the organization would share more security responsibility than just providing data.

Infrastructure as a Service (IaaS) places the most security responsibility on the customer, who must manage the OS, middleware, applications, and data security - far more than just supplying data.

Software as a Service (SaaS) is the cloud model where the third-party provider is responsible for managing the infrastructure, platform, application, and nearly all security controls, leaving the customer responsible only for their data and user access management. This aligns exactly with the scenario described, where the organization only provides data while the supplier handles all security. Examples include Microsoft 365 or Salesforce, where the vendor controls patching, encryption, and physical security.

Anything as a Service (XaaS) is a broad umbrella term referring to the delivery of any IT function over the internet, not a specific service model that defines the responsibility split described in the scenario.