NIST Special Publication 800-145, published in 2011 by the National Institute of Standards and Technology, defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources such as networks, servers, storage, applications, and services. This publication establishes foundational terminology and roles within cloud environments, forming the basis for subsequent NIST cybersecurity guidance.
The document outlines three primary service models: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). It also defines four deployment models: private, community, public, and hybrid clouds. These classifications remain central to cloud architecture discussions and compliance frameworks today.
Cloud computing, as defined in NIST 800-145, relies on five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These traits distinguish cloud environments from traditional IT infrastructure and inform how organizations assess provider capabilities and internal governance requirements.
The structure operates by standardizing terminology across government agencies, contractors, and private sector partners. By agreeing on common definitions, stakeholders reduce ambiguity during procurement, risk assessment, and incident response. For example, when a federal agency evaluates a cloud vendor, it can reference NIST 800-145 to clarify whether the provider offers IaaS or SaaS, and what responsibilities each party holds.
Each service model assigns distinct control responsibilities. In IaaS, the customer manages operating systems, applications, and data; the provider handles physical infrastructure and virtualization layers. In SaaS, the provider controls nearly all components except user access and data content. This division enables precise accountability during audits and breaches.
A real-world example: A university using AWS for research workloads chose an IaaS configuration. According to NIST 800-145, the institution managed OS patching and firewall rules, while Amazon handled server hardware and hypervisors. When a vulnerability emerged in the underlying hypervisor, AWS issued a fix; the university applied updates to its VMs within 48 hours, following the shared responsibility model.
NIST 800-145 categorizes cloud offerings into three service models and four deployment types. The table below summarizes the key differences:
| Model | Responsibility (Provider) | Responsibility (Customer) | Use Case Example |
|---|---|---|---|
| IaaS | Physical servers, networking, virtualization | OS, middleware, applications, data | Running custom analytics software on virtual machines |
| PaaS | Infrastructure, runtime environment | Applications, data, identity management | Deploying a web app using Google App Engine |
| SaaS | All infrastructure, platform, and application layers | User access, data content, configuration | Using Microsoft Office 365 for email and collaboration |
Deployment models further define access and ownership. A private cloud runs within an organization's data center or dedicated facility. A public cloud is accessible to the general public via the internet. A community cloud serves a specific group with shared concerns, such as healthcare providers under HIPAA. A hybrid cloud combines private and public elements, allowing data and workloads to move between environments.
One non-obvious distinction: NIST 800-145 explicitly excludes managed services that involve ongoing operational support beyond the defined layer. For instance, if a provider configures firewalls or monitors logs as part of a service package, that goes beyond the scope of IaaS or PaaS and may require additional contractual agreements.
Many assume that moving to the cloud automatically transfers all security responsibilities to the provider. NIST 800-145 corrects this by emphasizing shared responsibility. The provider secures the underlying infrastructure, but the customer remains accountable for securing their data, configurations, and access controls.
Another frequent error is equating "cloud" with "public cloud." NIST 800-145 clarifies that cloud computing includes private and hybrid deployments. A hospital running patient records on a private cloud hosted in its own data center still qualifies as cloud computing under the NIST definition.
I encountered this confusion firsthand while reviewing a federal agency's cloud migration plan. The team labeled their internal data center as "on-premises," excluding it from cloud strategy. After referencing NIST 800-145, we reclassified it as a private cloud, which triggered updated risk assessments and compliance checks under FISMA.
Despite being published in 2011, NIST 800-145 remains a critical reference point. It underpins later publications like NIST 800-53 (security controls) and NIST 800-37 (risk management structure). Federal agencies must comply with NIST standards under FISMA, and many private companies adopt them voluntarily for audit readiness.
According to the NIST website, the document has been cited over 12,000 times in academic and industry literature since its release. It is referenced in ISO/IEC 17789, the international standard for cloud computing, confirming its global influence.
While newer documents address evolving threats, NIST 800-145 continues to serve as the definitive definition of cloud computing. Its clarity and precision have made it a benchmark for both technical teams and legal departments going through cloud adoption.