Everyone talks about “the cloud”, but what is cloud computing? It is on-demand network access to a shared pool of computing resources, like servers, storage and applications, that you can start and stop quickly without running them yourself.
Cloud computing is one idea within the wider world of types of technology, and it is easier to grasp once you see how it is defined.
| Item | Value |
|---|---|
| Definition document | NIST Special Publication 800-145 |
| Published | September 28, 2011 |
| Authors | Peter Mell and Timothy Grance |
| Essential characteristics | Five |
| Service models | Three |
| Deployment models | Four |
These figures come from the NIST publication page and a Secureframe glossary entry. Pages and definitions can change, so check the source before you rely on them.
The official definition in plain English
A clear, standard definition comes from the National Institute of Standards and Technology (NIST), which published it as Special Publication 800-145 on September 28, 2011. You can read the abstract on the NIST page.
That abstract describes cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources. The resources it lists are networks, servers, storage, applications and services.
Each part of that sentence carries a meaning:
- On-demand network access: you reach the resources over a network when you need them.
- Shared pool: the resources come from a common pool rather than from one machine set aside only for you.
- Rapidly provisioned and released: you can start using resources quickly and give them back when you are done.
- Minimal management effort: little hands-on work, and little back-and-forth with the provider, is needed.
In everyday terms, the cloud is less a single place than a way of using computing: you rent what you need instead of owning and maintaining all of it.
What makes something cloud computing?
According to NIST, the cloud model is composed of five essential characteristics. The keywords on the same page name several of them:
- On-demand self service: you can set up what you need yourself, without waiting for a person to do it.
- Pooling of resources: many users draw on the same shared pool.
- Rapid elasticity: the amount you use can grow or shrink quickly.
- Measured service: as the name suggests, use is measured, which is what makes pay-for-what-you-use pricing possible.
The abstract’s wording about network access is the other thread running through the definition. If a service lacks these traits, it may be hosted somewhere else without really being cloud computing in the NIST sense.
The three service models: SaaS, PaaS and IaaS
The same NIST abstract says the model includes three service models. They are Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS).
A simple way to tell them apart is to ask how much you get ready-made:
- IaaS sits closest to the raw resources, such as servers, storage and networks.
- PaaS adds a platform on top, so you can focus on building your own applications.
- SaaS hands you a finished application to use.
None of these is better in every case. The right one depends on how much control you want and how much upkeep you would rather leave to the provider.
Public, private and hybrid deployment
The service models describe what you receive. The deployment models describe where and for whom the cloud runs. NIST counts four of them, while Secureframe’s summary of the document names public, private and hybrid cloud.
In general terms, a public cloud serves many customers, a private cloud serves one organisation, and a hybrid setup combines the two. Which fits best is a question of who needs access, how sensitive the work is and how much you want to manage.
How to use the definition when you compare services
The definition works as a checklist when a product claims to be “cloud”. Run through these steps:
- Check whether you can get resources on demand and release them again without long delays.
- Ask whether the resources come from a shared pool and can grow or shrink with your needs.
- Look for how use is measured and reported to you.
- Decide whether you need infrastructure, a platform or a finished application.
- Decide which deployment model suits your situation.
Keep in mind what the document is not. Secureframe’s glossary notes that it is a definition rather than a compliance standard, so it does not set specific controls or requirements.
Cloud services are reached over a network, and if you are curious about the wireless link at your end, the guide on how does wifi work is a useful companion. Cloud computing also often comes up alongside smart software, which you can explore in what is artificial intelligence.
Frequently asked questions
Is the cloud a physical place?
Show answer
Not in the way the name suggests. The NIST definition describes a model for network access to a shared pool of configurable resources, not a single location.
What do SaaS, PaaS and IaaS stand for?
Show answer
They stand for Software as a Service, Platform as a Service and Infrastructure as a Service. They are the three service models named on the NIST page.
Do I have to follow the NIST definition?
Show answer
No. According to Secureframe, it is a definition and not a compliance standard, so it dictates no specific audits or controls. It is a shared vocabulary for comparing services.
Has the definition been updated since it was published?
Show answer
Secureframe’s glossary says the document was published in September 2011 and has had no major updates since. Check the NIST page for the latest status.
Who is the definition written for?
Show answer
Per Secureframe, the intended audience is cloud service providers, system planners, program managers, technologists and others adopting cloud computing as consumers.
