The NIST Definition of Cloud Computing
Original title NIST SP 800-145: The NIST Definition of Cloud Computing
National Institute of Standards and Technology · Peter Mell, Timothy Grance
A three-page NIST publication that defines cloud computing through five essential characteristics, three service models and four deployment models. It gives a shared vocabulary for comparing cloud services and deployment strategies.
U.S. public domain — U.S. Government work; free to reuse
On this page
Overview
Published in September 2011 by Peter Mell and Timothy Grance of the NIST Computer Security Division, the document was prepared for federal agencies but may be used voluntarily by other organisations and is not subject to copyright. Its purpose is to support broad comparisons of cloud services and deployment strategies and to give a baseline for discussion, from what cloud computing is to how best to use it. The service and deployment models form a simple taxonomy that does not prescribe any method of deployment, delivery or business operation.
The definition describes cloud computing as a model for ubiquitous, convenient, on-demand network access to a shared pool of configurable resources (networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort. The five essential characteristics are on-demand self-service, broad network access, resource pooling (a multi-tenant model), rapid elasticity and measured service.
Three service models are defined: SaaS, where the consumer uses the provider's applications; PaaS, where the consumer deploys its own or acquired applications using the provider's tools; and IaaS, where the consumer provisions processing, storage and networks and runs arbitrary software. The four deployment models are private, community, public and hybrid clouds. A footnote splits cloud infrastructure into a physical layer of server, storage and network hardware and an abstraction layer of software above it.
Key points
- The cloud model has five essential characteristics, three service models and four deployment models.
- The five characteristics are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
- With resource pooling the customer generally does not know the exact location of resources but may specify it at a higher level such as country, state or datacenter.
- Measured service is typically on a pay-per-use or charge-per-use basis.
- In SaaS the consumer does not manage the infrastructure; in PaaS it controls deployed applications and possibly hosting-environment settings; in IaaS it controls operating systems, storage and deployed applications.
- A private cloud is for a single organisation and may be on or off premises; a public cloud exists on the provider's premises.
- A community cloud serves a community with shared concerns such as mission, security requirements, policy and compliance.
- A hybrid cloud binds two or more distinct clouds with technology that enables data and application portability, for example cloud bursting.
Using it in design
- Use the NIST terms when describing on-prem and SaaS delivery of the platform: an on-prem installation is a private cloud, a hosted service is SaaS.
- In data-centre capacity planning, state the customer-facing service model (IaaS, PaaS, SaaS), because the layer the provider manages, and so the facility's responsibility, differs in each.
- Treat resource pooling and rapid elasticity as inputs to demand variability when sizing power and cooling shares together with redundancy.
- Record private or community cloud as a separate facility requirement for customers with location or confidentiality needs, distinct from public cloud.
Monthly newsletter · free
Keep your reading list current
Once a month: new library sources, changes to Turkish regulations and upcoming data centre events.
SoSo CAD
Assess redundancy through scenarios
Compare normal operation and equipment failures in SoSo CAD, with supplied loads and capacity shortfalls in one view.
Request a demo
Who should read it
System planners, programme managers and technologists adopting cloud computing as consumers or providers.
Document contents
- 1. Introduction
- 1.1 Authority
- 1.2 Purpose and Scope
- 1.3 Audience
- 2. The NIST Definition of Cloud Computing
- Essential Characteristics
- Service Models
- Deployment Models
Read the document
nist-sp-800-145-cloud-definition.pdf
U.S. public domain — U.S. Government work; free to reuse
The document is provided unaltered because its licence permits redistribution.
Publication details
- Authors
- Peter Mell; Timothy Grance
- Publisher
- National Institute of Standards and Technology
- Year
- 2011
- Document number
- NIST SP 800-145
- Document language
- English
- Source type
- Expert / community
- Access
- Open licence — downloadable
- Licence
- U.S. public domain — U.S. Government work; free to reuse
- Licence evidence
- www.copyright.gov
Original licence note
NIST publication available free of charge via doi.org/10.6028; the front-matter authority/copyright statement says it is not subject to copyright in the United States (attribution appreciated); U.S. government work under 17 U.S.C. 105.
Citation
Peter Mell; Timothy Grance (2011). NIST SP 800-145: The NIST Definition of Cloud Computing. National Institute of Standards and Technology. NIST SP 800-145. https://doi.org/10.6028/NIST.SP.800-145
Events on this subject
- Data Center World Middle East
- Datacenter Forum Stockholm
- Gartner IT Infrastructure, Operations & Cloud Strategies Conference
All content and rights belong to the respective authors and publishers. SoSo CAD provides only the citation, its own summary and a link to the source, and is not responsible for the sources' content.
Related sources
All sources on this topic
National Institute of Standards and Technology 2025
NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
Add media sanitization to the facility's storage and server lifecycle plan at commissioning, and label media with the confidentiality category of the system.
- Cryptographic erase: at least 128 bits of security strength, key sanitization by ISO/IEC 19790 zeroization, ECB mode not allowed.
National Institute of Standards and Technology 2024
The NIST Cybersecurity Framework (CSF) 2.0
Create separate Organizational Profiles for a facility's IT, OT and building management systems (for example electrical and cooling SCADA/BMS) and state each Profile's scope.
- The Core has 22 Categories with Subcategories; the outcomes are not a checklist.
National Institute of Standards and Technology 2023
NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
Zone the data centre's electrical (UPS, generator, ATS) and mechanical (cooling, HVAC) control systems as an OT network, separated from the corporate IT network by a DMZ.
- Network architecture should characterise, segment and isolate IT and OT devices, using the Purdue model, ISA-95 or an IIoT model, with a DMZ.
National Institute of Standards and Technology 2010
NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
Derive MTD, RTO and RPO from the BIA for the data centre and translate them into UPS and generator runtime, cooling redundancy and replication architecture requirements.
- Systems supporting mission essential functions must meet an MTD of 12 hours or less.
arXiv preprint (University of Alberta) 2026
To Defer or To Shift? The Role of AI Data Center Flexibility on Grid Interconnection
In large-load interconnection negotiation, present AI load flexibility (a deferral window of up to about 3 hours) as a lever for interconnection capacity and timing; returns diminish beyond 3 hours.
- In the IEEE 14-bus study, data centres on buses connected to congested lines benefit most from geographic load shifting.
Standards (MDPI AG) 2026
Arc-Flash Hazards: Standards Development Framework in Facilities of National Importance in Healthcare and Data Centers
Schedule the arc-flash study after the coordination study and make that order a mandatory step in the project plan and model.
- Example studies assumed available utility fault current of 21,000 A for the 440 V residential service and 21,000-40,000 A for the 480 V/1200 A commercial service.