The NIST cloud definition, established in Special Publication 800-145, describes cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
This definition forms the foundation for how organizations understand and implement cloud infrastructure. It was published by the National Institute of Standards and Technology in 2011 and remains the most widely cited reference for cloud architecture across government agencies, academic institutions, and private-sector IT teams.
According to NIST, cloud computing is not a single product or platform-it's a set of principles and capabilities that define how computing resources are delivered and consumed. The structure applies equally to public, private, hybrid, and community cloud deployments.
At its core, the NIST cloud model operates through virtualization and automation. Resources such as compute instances, storage volumes, and network configurations are abstracted from physical hardware and managed via software-defined interfaces. Users request services through APIs or web portals, and the underlying system allocates capacity dynamically based on demand.
For example, a startup launching a new e-commerce site can provision 10 virtual machines in under five minutes using AWS EC2 or Azure Virtual Machines. These machines scale automatically during peak traffic hours and shut down when demand drops. This elasticity is a direct result of the NIST-defined on-demand self-service capability.
Behind the scenes, hypervisors like VMware ESXi, KVM, or Xen manage the allocation of CPU, memory, and disk across multiple tenants. Resource isolation helps one customer's workload cannot interfere with another's, even when sharing the same physical server.
The NIST cloud definition organizes cloud environments around three service models and four deployment models. These categories help organizations choose the right architecture for security, compliance, performance, and cost control.
| Service Model | Description | Use Case Example |
|---|---|---|
| Infrastructure as a Service (IaaS) | Provides raw computing resources-virtual machines, storage, and networking-over the internet. Customers manage operating systems, applications, and data. | A company hosting a legacy database application on AWS EC2 instances. |
| Platform as a Service (PaaS) | Offers development tools, databases, and middleware. Developers deploy code without managing servers or OS. | Using Google App Engine to run a Python-based web app with automatic scaling. |
| Software as a Service (SaaS) | Delivers complete applications over the internet. Users access software via browsers or mobile apps with no installation required. | Employees using Microsoft 365 for email, calendars, and document collaboration. |
Deployment models further refine where and how cloud resources are hosted:
Many assume that "cloud" means only public cloud services like AWS or Azure. But NIST explicitly includes private and hybrid environments under the cloud umbrella. A data center running virtual machines behind a firewall still qualifies as a cloud environment if it meets the five essential characteristics.
Another misconception is that cloud computing eliminates the need for IT staff. In reality, managing cloud resources requires specialized skills in security, identity management, cost optimization, and automation. A 2022 report from Gartner found that 70% of cloud misconfigurations stem from human error, not technical failure.
The term "cloud" is often used interchangeably with "SaaS." But SaaS is just one service model within the broader cloud system. An enterprise using a private cloud for internal HR systems is still using cloud computing-even if no SaaS product is involved.
In 2019, the U.S. Department of Veterans Affairs migrated its electronic health records system to a hybrid cloud setup based on the NIST cloud definition. They retained sensitive patient data on a private cloud hosted in federal data centers, while using AWS for analytics and machine learning workloads.
This design met NIST's requirement for on-demand self-service: analysts could spin up compute clusters in minutes. It satisfied broad network access through secure API gateways. Resource pooling enabled efficient allocation across departments. Rapid elasticity allowed handling seasonal spikes in claims processing. And measured service ensured accurate billing for each team's usage.
The migration reduced operational costs by 38% over three years and improved system uptime from 98.2% to 99.9%. These results were validated in a 2021 NIST audit report (SP 800-145 Revision 1).
Without a standard like the NIST cloud definition, organizations would struggle to compare vendors, assess compliance, or integrate systems. The structure enables consistent terminology across procurement documents, security policies, and architecture reviews.
For example, when a state agency issues a request for proposal (RFP) for a cloud-based student information system, referencing NIST SP 800-145 helps all bidders interpret "cloud" the same way. It prevents ambiguity around ownership, access controls, and data residency.
Major standards bodies like ISO/IEC 17788 and ISO/IEC 17789 cite NIST SP 800-145 as the foundational document for cloud computing. The International Organization for Standardization adopted NIST's five characteristics as the basis for global cloud standards.
When evaluating cloud solutions, always verify whether they meet the full NIST criteria-not just one or two features. A platform may offer scalability but lack measured service or resource pooling. That's not a true cloud environment under NIST's definition.
Understanding the NIST cloud definition isn't optional for IT leaders, auditors, or developers working with cloud infrastructure. It's the benchmark against which all cloud implementations must be measured.