IaaS (Infrastructure as a Service)
Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment. Under Cyber Essentials v3.3 IaaS is always in scope (A2.9). Most controls are shared with the provider, and Cyber Essentials Plus scans and tests IaaS instances like your own servers.
- Term
- IaaS
- Also known as
- IaaS, Infrastructure as a Service, Cloud servers
- Category
- Malware, cloud and threats
- Requirement area
- D(iv) Cloud services
- Questions
- A2.9A7.16AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term IaaS mean in Cyber Essentials?
Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
Infrastructure as a Service (IaaS) – the cloud provider delivers virtual servers and network equipment that, much like physical equipment, your organisation configures and manages. Examples of IaaS include Rackspace, Google Compute Engine, or Amazon EC2
How does IaaS apply to Cyber Essentials?
In plain terms
IaaS is like leasing an empty unit on an industrial estate. The landlord provides the building, the power and the security gate. You fit it out, choose the locks and look after everything inside. In IT terms you rent virtual servers and networks, then install, configure and update them yourself. The requirements give Rackspace, Google Compute Engine and Amazon EC2 as examples.
What Cyber Essentials asks
IaaS cannot be excluded from scope and goes in A2.9. Table 1 of the requirements shows that for IaaS, firewalls, secure configuration, security update management and malware protection are typically implemented by both your organisation and the cloud provider. User access control is yours alone, including MFA for administrators of the cloud console (A7.16).
In practice your share is most of what sits inside each virtual machine: its operating system updates, its firewall rules (for cloud services the requirements refer to data flow policies), its accounts and its anti-malware. The provider looks after the physical hosts and the network underneath.
What an assessor looks for
Cyber Essentials Plus treats IaaS much like your own servers:
- Test case 1 scans your public IP addresses, and the specification says this "must include IaaS where used".
- Test case 2, the authenticated scan, runs on sampled "EUD, servers and IaaS instances".
- Test case 3 runs on sampled "EUD, servers that provide a user-interactive desktop and IaaS instances".
See cloud services scope, AWS setup and Azure setup. Related: PaaS, virtual machine.
Related terms
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
Frequently asked questions
Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, IaaS comes up at A2.9, A7.16. Read those questions against the definition above so your answers use the term the way the assessor will.
IaaS relates to D(iv) Cloud services in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.