NIST Special Publication 800-145 is the U.S. government’s official definition of cloud computing. Issued by the National Institute of Standards and Technology in September 2011, the two-page document sets a technology-neutral test built from five essential characteristics, three service models, and four deployment models. 1National Institute of Standards and Technology. The NIST Definition of Cloud Computing It remains the active, unrevised federal standard and underpins FedRAMP authorizations along with much of the shared vocabulary used across the private sector.
The core definition describes cloud computing as on-demand network access to a shared pool of configurable resources — servers, storage, applications, and networking — that can be provisioned and released quickly with minimal management effort from the provider. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing If a vendor labels a service “cloud” but standing up a server still requires a support ticket and a three-day wait, it doesn’t meet the standard. The definition names no vendors, protocols, or hardware; it describes what using the service must look like, then breaks that experience into testable parts.
The Five Essential Characteristics
A service must exhibit all five traits to qualify as cloud computing under SP 800-145. Missing even one puts the offering outside the definition, whatever the marketing says. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
On-Demand Self-Service
You provision computing capabilities like storage or server time on your own, through an automated interface, whenever you need them. No phone calls, no queued tickets, no human on the provider’s end flipping a switch. This is the trait that most sharply separates cloud from traditional managed hosting.
Broad Network Access
Capabilities are available over the network using standard mechanisms and work across a range of client devices, from phones and tablets to laptops and workstations. A service reachable only through a proprietary on-premises terminal doesn’t qualify.
Resource Pooling
The provider serves multiple customers from the same pool of physical and virtual resources, assigning and reassigning capacity dynamically according to demand. You generally don’t know or control the exact location of your workload, though you may be able to specify at a higher level of abstraction such as country or region. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing This multi-tenant arrangement is what makes cloud economics work.
Rapid Elasticity
Resources scale outward and inward quickly, sometimes automatically, to match actual demand. From the customer’s vantage point, available capacity appears effectively unlimited. You take more when traffic spikes and release it when traffic drops.
Measured Service
The system meters usage at a level appropriate to the service — storage, processing, bandwidth, or active user accounts — and reports it transparently to both customer and provider. Billing is typically pay-per-use, though metering can also serve internal cost tracking without a direct bill attached. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
The Three Service Models
SP 800-145 divides cloud services into three layers. The practical difference between them is how much of the technology stack the provider controls versus how much you control. Moving from SaaS down to IaaS, you pick up flexibility and responsibility together.
Software as a Service (SaaS)
You use the provider’s application running on their cloud infrastructure. The provider manages the servers, operating system, network, and application code. Your control is limited to user-specific settings and preferences. Email platforms, CRM tools, and project management applications are typical examples. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
Platform as a Service (PaaS)
You deploy your own applications onto the provider’s infrastructure using their supported programming languages, libraries, and tools. You control your deployed code and some hosting-environment settings; the provider still manages the servers, operating systems, and storage. Development and testing environments are common PaaS uses. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
Infrastructure as a Service (IaaS)
You get raw processing, storage, and networking capabilities and install whatever operating systems and applications you want on top. The provider manages the physical hardware and the virtualization layer beneath your virtual machines. Everything above that, including operating system patching and application security, is yours. Limited control over select networking components such as host firewalls may also be available. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
Who Manages What
The service model decides which security and maintenance tasks fall on you and which fall on the provider. In SaaS, the provider handles nearly everything; you manage user-level configurations and your own data. In PaaS, you own your deployed applications and their configurations, and the provider owns the runtime, operating system, and all physical infrastructure below it. In IaaS, you manage the guest operating system, all middleware, and all applications; the provider manages only the physical hardware and the hypervisor.
This split matters most during security incidents. A vulnerability in the operating system of an IaaS deployment is the customer’s to patch. The same patch in a SaaS arrangement is the provider’s problem. Misreading which side of the line a task falls on is one of the most common causes of cloud security failures.
The Four Deployment Models
Beyond the service model, SP 800-145 classifies clouds by who has access and who owns the infrastructure. 1National Institute of Standards and Technology. The NIST Definition of Cloud Computing
Private Cloud
The infrastructure is provisioned for exclusive use by a single organization, which may have multiple internal users across business units. The organization, a third party, or some combination can own and operate it, and it may sit on or off the organization’s premises. The defining feature is exclusive use, not physical location.
Community Cloud
The infrastructure serves a specific group of organizations that share concerns such as mission, security requirements, or compliance obligations. Healthcare providers subject to the same data-handling rules or defense contractors working under shared clearance requirements are typical users.
Public Cloud
The infrastructure is provisioned for open use by the general public. A business, academic institution, or government organization may own and operate it, and it exists on the provider’s premises. The major commercial cloud platforms fall here.
Hybrid Cloud
A hybrid cloud combines two or more distinct cloud infrastructures — say, a private cloud and a public cloud — that remain separate entities but are bound together by technology enabling data and application portability. The example SP 800-145 gives is “cloud bursting,” where a private cloud offloads excess demand to a public cloud during traffic spikes. 2National Institute of Standards and Technology. The NIST Definition of Cloud Computing
SP 800-145 does not define “multi-cloud.” In current industry usage, multi-cloud generally refers to using services from several public providers at once, while hybrid specifically bridges different deployment types. Only hybrid is in the NIST standard.
How FedRAMP Uses SP 800-145
The most consequential real-world application of the standard is the Federal Risk and Authorization Management Program. FedRAMP requires every cloud service provider seeking authorization to sell to federal agencies to classify its offering using the SP 800-145 service and deployment models. 3FedRAMP Documentation. Important Considerations The classification determines the security control baselines the provider must implement and the scope of the authorization assessment. Misclassification can trigger a complete re-evaluation.
FedRAMP layers its own distinctions on top of the deployment models. A “government-only community” cloud, where only government data is stored and only government-adjacent customers have access, is treated separately from a standard public cloud. Private clouds deployed entirely within a federal facility sit outside the FedRAMP mandate, but a private cloud running on a third-party IaaS platform still requires authorization. 3FedRAMP Documentation. Important Considerations
Testing a Service Against the Definition
NIST published a companion document, SP 500-322, to help organizations determine whether a given service actually meets the SP 800-145 definition. 4National Institute of Standards and Technology. Evaluation of Cloud Computing Services Based on NIST SP 800-145 For each essential characteristic, SP 500-322 offers two evaluation tiers. Option A is the stronger evidence: the service is fully automated end to end. For on-demand self-service, that means automated provisioning behind the scenes, not just an automated front end. For resource pooling, it means multiple independent customers verifiably share the same infrastructure. Option B is weaker but acceptable: the customer-facing experience is automated even if the provider uses some manual processes internally. A ticketing system can satisfy the self-service requirement if provisioning is fast enough to meet the service-level agreement.
The framework also clarifies who can confirm each characteristic. Broad network access can be verified by either the customer or the provider. On-demand self-service, where the real question is whether internal provisioning is automated, can only be confirmed by the provider, because the customer sees only the interface.
What SP 800-145 Does Not Cover
SP 800-145 is a definition, not a security framework or an architecture guide. A few things people often expect to find in it that aren’t there:
- Security controls. SP 800-145 does not tell you how to secure a cloud environment; NIST addresses that in other publications in the 800 series.
- Reference architecture. NIST SP 500-292 extends the definition into a full reference architecture with defined roles, actors, and activities for managing cloud services.5National Institute of Standards and Technology. NIST Cloud Computing Reference Architecture
- Newer paradigms. Serverless computing, container orchestration platforms, and edge computing did not exist in their current form when the document was finalized in 2011. The standard makes no mention of them. They can often be mapped onto the SaaS/PaaS/IaaS framework, but the fit isn’t always clean, and NIST has not published an update to address the gap.
For cloud procurement or compliance work, SP 800-145 is the starting point. It supplies a shared vocabulary and a mandatory-characteristics checklist. The detailed architectural, security, and contractual decisions live in the broader ecosystem of NIST cloud publications built around it.