Cloud computing 101: the NIST definition, service models and deployment models
Most cloud arguments are really definition arguments. NIST settled the definition in 2011, and it still sorts out what counts as cloud and what is hosting with a new label.
In September 2011, the US National Institute of Standards and Technology published Special Publication 800-145, a two-page definition of cloud computing written by Peter Mell and Tim Grance. It describes cloud computing as a model for convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.
That definition has become the reference point for contracts, audits and vendor claims, because it gives a test. A service that lacks the essential characteristics isn't cloud, whatever the brochure says.
The five essential characteristics
| Characteristic | What it means in practice |
|---|---|
| On-demand self-service | You can provision servers or storage yourself, without raising a ticket with the provider |
| Broad network access | Services are reachable over the network from standard devices |
| Resource pooling | The provider serves many customers from shared infrastructure |
| Rapid elasticity | Capacity scales up and down quickly, often automatically |
| Measured service | Usage is metered, and you pay for what you use |
A hosted server that takes a week to order and bills a fixed monthly fee may be a perfectly good service, but it fails at least two of these tests.
The three service models
NIST defined Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). The difference is how much of the technology stack the provider runs for you. Our IaaS vs PaaS vs SaaS guide covers them in detail.
The four deployment models
| Model | Who uses it |
|---|---|
| Public cloud | Open to any customer, run by a provider such as AWS, Microsoft Azure or Google Cloud |
| Private cloud | Used by one organization, on its premises or hosted by a third party |
| Community cloud | Shared by a group of organizations with common needs, such as government agencies |
| Hybrid cloud | A combination of two or more of the above, connected so data and applications can move between them |
Hybrid is now the norm rather than the exception. Gartner predicted in November 2024 that 90% of organizations would adopt a hybrid cloud approach through 2027.
Why the definition still matters
The NIST terms show up in procurement, compliance frameworks and security standards. Knowing them helps in three places: checking whether a "cloud" product really scales and bills like one, deciding which security responsibilities stay with you, and comparing quotes on a like-for-like basis.
What IT teams should do
- Check new "cloud" contracts against the five characteristics, especially self-service and metered billing.
- Label each cloud service you use by service model and deployment model.
- Use the labels to confirm who is responsible for security at each layer.