PaaS (Platform as a Service)
Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications. Under Cyber Essentials v3.3 it is always in scope (A2.9), and user access control, including MFA (A7.16, A7.17), stays with you.
- Term
- PaaS
- Also known as
- PaaS, Platform as a Service
- Category
- Malware, cloud and threats
- Requirement area
- D(iv) Cloud services
- Questions
- A2.9A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term PaaS mean in Cyber Essentials?
Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
Platform as a Service (PaaS) – the cloud provider delivers and manages the underlying infrastructure, and your organisation provides and manages the applications. Examples of PaaS include Azure Web Apps and Amazon Web Services Lambda
How does PaaS apply to Cyber Essentials?
In plain terms
If SaaS is a furnished flat, PaaS is a serviced workshop. The landlord supplies the building, the power and the machinery and keeps them maintained. You bring your own projects and are responsible for what you make there. In IT terms, developers upload their code or website and the provider runs it without anyone looking after a server. The requirements give Azure Web Apps and Amazon Web Services Lambda as examples.
What Cyber Essentials asks
PaaS is a cloud service, so it cannot be excluded from scope and goes in A2.9. Table 1 of the requirements shows who typically implements each control:
| Control | Typically implemented by |
|---|---|
| Firewalls | The cloud provider and sometimes also your organisation |
| Secure configuration | Both your organisation and the cloud provider |
| Security update management | Both your organisation and the cloud provider |
| User access control | Your organisation |
| Malware protection | The cloud provider and sometimes also your organisation |
The requirements define software to include "interpreters, scripts, libraries", so the runtimes and libraries your application depends on need to stay supported and patched. Bespoke code is treated differently: "Bespoke and custom components of web applications are out of scope."
What an assessor looks for
- Evidence that the provider has committed to its share "via contractual clauses or documents referenced by contract, such as security statements or privacy statements".
- MFA for every administrator and user of the platform (A7.16, A7.17).
See cloud services scope and software development scope. Related: SaaS, IaaS.
Related terms
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
Frequently asked questions
Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, PaaS comes up at A2.9, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
PaaS relates to D(iv) Cloud services in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.