1. Executive Summary

When a Korean national or public institution adopts cloud computing, it is important to understand not only which cloud service will be used, but also what the cloud is intended to be used for and what type of cloud service is being provided.

The 「National Cloud Computing Security Guidelines (January 2023)」 classify cloud computing from two perspectives:

Classification by purpose

Business-purpose cloud computing
Public-purpose cloud computing

Classification by service type

IaaS — Infrastructure as a Service
PaaS — Platform as a Service
SaaS — Software as a Service
Combined services

The purpose of this classification is to help national and public institutions understand the characteristics of their cloud environment and establish appropriate security measures.

2. Why Is Cloud Classification Important?

When an institution considers moving a system to the cloud, it may initially seem sufficient to ask:

"Can we move this system to the cloud?"

In practice, however, this is not enough.

A public institution may operate:

Internal administrative systems
Employee work environments
Public websites
Citizen-facing online services
Email systems
Data analysis platforms
Development and testing environments
Cloud-based business applications

All of these may use cloud technology, but their purposes, connectivity, data sensitivity, and service models can be very different.

Therefore, an IT officer should be able to answer at least the following questions:

Is the system intended for internal business use or public-facing services?
Is the service IaaS, PaaS, SaaS, or a combined service?
What types of information and data are processed?
Who manages the cloud environment?
Which security and management responsibilities belong to the institution and which belong to the provider?

The Guidelines emphasize that cloud components may have different management entities depending on the cloud deployment and service model. Understanding the entire architecture and management scope is therefore essential.

3. Classification by Purpose

3.1 Business-Purpose Cloud Computing

Business-purpose cloud computing refers to cloud environments used for the administrative and operational work of an institution.

Existing:

Business servers
Business PCs
Business software

may be migrated into a cloud environment.

In simple terms:

Traditional environment

Business PC → Institutional Network → Physical Server

may become:

Cloud environment

Business PC → Institutional Network → Cloud Resources → Business Application

Because important institutional information may be stored in a business-purpose cloud, stronger security management is required.

4. Public-Purpose Cloud Computing

Public-purpose cloud computing refers to cloud resources that require Internet connectivity.

Typical examples include:

Institutional websites
Citizen-facing services
Mail servers
DNS servers
Public Internet services

The Guidelines point out that public-purpose cloud environments can be exposed to DDoS attacks, external hacking, and other attacks. Accordingly, security systems such as firewalls, IDS, IPS, and DDoS protection systems should be considered.

5. Business-Purpose vs. Public-Purpose Cloud

Category	Business-Purpose Cloud	Public-Purpose Cloud
Main purpose	Internal institutional work	Public/citizen-facing services
Main users	Employees/internal users	Citizens/external users
Examples	Administrative systems	Websites and public services
Connectivity	Primarily institutional networks	Internet connectivity
Major concerns	Unauthorized access and information leakage	External attacks and DDoS
Security focus	Access control and information protection	External attack protection and availability

The distinction does not mean that one type is inherently "secure" and the other is not. Rather, they have different exposure characteristics and therefore require security measures appropriate to their respective environments.

6. Classification by Service Type

The Guidelines classify cloud computing services into:

IaaS
PaaS
SaaS
Combined services

The easiest way to understand these models is:

IaaS = Rent computing infrastructure
PaaS = Rent a development platform
SaaS = Use ready-to-use software

7. IaaS — Infrastructure as a Service

IaaS provides infrastructure resources such as:

Virtual servers
Storage
Networks

through a virtualized environment.

The Guidelines describe IaaS as a service that provides infrastructure resources in virtualized form so that they can be used as needed.

For a public institution, an example could be creating a virtual server for a website without purchasing and installing a physical server.

However, using IaaS does not mean that the cloud provider automatically handles every security responsibility.

The institution may still need to manage:

Operating systems
Applications
User accounts
Access privileges
Security configurations
Data protection
Logging
Vulnerability management
Backup and recovery

8. PaaS — Platform as a Service

PaaS provides a development platform without requiring the institution to build the entire development environment itself.

The Guidelines describe PaaS as a service that provides development platform resources in a virtualized environment.

For example, developers may use a cloud-based application development environment and database environment instead of building those platforms themselves.

This allows developers to focus more on application development while the cloud provider manages the underlying platform.

9. SaaS — Software as a Service

SaaS provides applications through a network without requiring users to install the software locally.

The Guidelines describe SaaS as a model in which application software is provided through a network.

Examples mentioned in the Guidelines include:

Web office applications
Video conferencing
Collaboration solutions

For public institutions, SaaS adoption should therefore involve questions such as:

Where is the data stored?
Who manages the data?
How are administrators controlled?
How is user authentication performed?
How are logs retained?
How are backups performed?
What happens when the contract ends?
Can the institution retrieve its data?
How are external integrations controlled?

10. Combined Cloud Services

The Guidelines define combined services as services that combine two or more of IaaS, PaaS, and SaaS.

DaaS, or Desktop as a Service, is provided as an example.

A DaaS environment may combine:

Virtual Infrastructure + Virtual PC + Software

into a single service for users.

11. The Difference Between IaaS, PaaS and SaaS

A simple way to remember the three models is:

IaaS

"Please provide me with computing infrastructure."

The institution uses virtual servers, storage, and networking.

PaaS

"Please provide me with an environment where I can develop applications."

Developers use the platform supplied by the cloud provider.

SaaS

"Please provide me with the completed application."

Users access the application through the network.

Combined Service

"Please combine multiple cloud services into one service."

DaaS is a representative example.

12. Purpose and Service Type Are Different Classification Criteria

One of the most important points for public-sector IT officers is that:

Business-purpose/public-purpose and IaaS/PaaS/SaaS are not competing classifications.

They describe the cloud from different perspectives.

For example:

Purpose	Service Type	Example
Business-purpose	IaaS	Internal administrative server
Business-purpose	PaaS	Internal application development
Business-purpose	SaaS	Internal collaboration service
Public-purpose	IaaS	Public website infrastructure
Public-purpose	PaaS	Public-service development platform
Public-purpose	SaaS	Public-facing application

Therefore, when planning a cloud project, it is useful to ask two separate questions:

What is the purpose?

and

What type of service is being used?

13. Practical Cloud Classification Process

For public-sector IT projects, the following process can be useful.

Step 1. Identify the purpose

Is it for internal administrative work?

→ Business-purpose cloud

Is it for an Internet-facing public service?

→ Public-purpose cloud

Step 2. Identify the service model

Virtual infrastructure?

→ IaaS

Development platform?

→ PaaS

Completed application?

→ SaaS

Multiple models combined?

→ Combined service

Step 3. Assess system importance

Consider:

Confidentiality
Integrity
Availability
Importance of the information
Potential impact of a security incident

Step 4. Determine the appropriate cloud area

The Guidelines separately provide cloud-area classifications and system-importance classification procedures.

Step 5. Establish security requirements

Finally, determine appropriate requirements for:

Access control
Encryption
Security monitoring
Incident response
Backup
Disaster recovery
Logging
Vulnerability management

14. Practical Checklist for Public Institutions

Before starting a cloud project, an information officer can ask:

Cloud Classification

□ Is the system business-purpose or public-purpose?

□ Does it require Internet connectivity?

□ Does it connect to the institutional business network?

□ Is it a citizen-facing service?

□ Is it IaaS?

□ Is it PaaS?

□ Is it SaaS?

□ Is it a combined service?

Information Protection

□ What type of information will be processed?

□ Does the system process personal information?

□ Does it contain confidential institutional information?

□ What is the impact if the system is compromised?

Cloud Management

□ Who manages the infrastructure?

□ Who manages the operating system?

□ Who manages the application?

□ Who controls administrative privileges?

□ Where is the data stored?

□ How is backup performed?

□ How is disaster recovery performed?

□ How are security logs managed?

□ How is security monitoring performed?

□ What happens to the data when the contract ends?

15. The Key Lesson: "Cloud" Does Not Automatically Mean "Secure"

Cloud computing can improve resource efficiency, scalability, and centralized management, but it also introduces security risks.

The Guidelines identify risks such as:

Concentration of data
Large-scale data leakage
Service-wide disruption caused by failures
Shared vulnerabilities
Risks associated with multi-tenancy
Unauthorized access to virtual resources

Therefore, the key question for a public institution should not simply be:

"Should we use cloud computing?"

Instead, the more important questions are:

What data will be processed?

Which cloud environment will be used?

What service model will be adopted?

Who is responsible for each security control?

16. Conclusion

The "Cloud Computing Classification" section of the 「National Cloud Computing Security Guidelines (January 2023)」 provides an important starting point for public-sector cloud adoption.

The classification can be remembered as follows:

By purpose

Business-purpose cloud

vs.

Public-purpose cloud

By service model

IaaS

→ Infrastructure

PaaS

→ Development platform

SaaS

→ Application software

Combined services

→ Two or more service models combined

For a national or public institution, however, classification is only the beginning.

A practical cloud adoption process should proceed from:

Cloud classification

→ System importance assessment

→ Cloud-area classification

→ Security requirement verification

→ Security review

→ Security control implementation

The 2023 Guidelines should also be read together with the regulations and guidance currently in force when an actual project is planned. The current "Notice on the Standards for the Use of Cloud Computing Services by Administrative and Public Institutions and Measures to Ensure Safety" is identified by the Korean Law Information Center as having been partially amended and effective as of December 29, 2025.