Infrastructure as a service (IaaS)

With IaaS, the provider manages the physical infrastructure while the manufacturer controls everything above it. The manufacturer remains responsible for assuring the software it runs there when it supports production or the quality system.

The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

FDA guidance: Computer Software Assurance for Production and Quality Management System Software (February 2026), Section IV, Definitions