What is cloud computing? The NIST model explained (IaaS, PaaS, SaaS)

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources — networks, servers, storage, applications, and services — that can be rapidly provisioned and released with minimal management effort. That wording is the official definition from NIST SP 800-145, the standard reference for what counts as cloud. The model is built from five essential characteristics, three service models (IaaS, PaaS, SaaS), and four deployment models (public, private, community, hybrid). This guide explains each piece and how to pick the right one.

What makes something "cloud"? The five characteristics

According to NIST, a service is only truly cloud if it has all five essential characteristics:

• On-demand self-service. A consumer can provision computing capabilities — servers, storage, applications — unilaterally, whenever needed, without requiring human interaction with the provider. You sign up and spin resources up yourself.
• Broad network access. Capabilities are available over the network through standard mechanisms, and can be used from heterogeneous client platforms: laptops, phones, tablets, workstations.
• Resource pooling. The provider's computing resources are pooled to serve multiple consumers, with physical and virtual resources dynamically assigned and reassigned according to demand. The customer generally has no control or knowledge over the exact location of the provided resources — hence the common "your data lives somewhere" trade-off.
• Rapid elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward. To the consumer, the available capacity often appears unlimited.
• Measured service. Resource usage is monitored, controlled, and reported, providing transparency for both provider and consumer. This metering is what makes pay-as-you-go billing possible.

If a product is missing one of these — say, you must email a salesperson to provision anything (no self-service), or capacity is fixed and cannot scale (no elasticity) — it is not cloud in the NIST sense, even if it is hosted online.

The three service models

The service models describe how much of the stack the provider manages for you.

Infrastructure as a Service (IaaS)

IaaS gives you the fundamental building blocks: processing, storage, networks, and other computing resources, on demand. You can deploy and run arbitrary software — including an operating system of your choice — and you manage the OS, storage, and applications yourself. The provider manages the physical infrastructure below that. Examples include Amazon EC2 (AWS), Google Compute Engine, Microsoft Azure virtual machines, and DigitalOcean Droplets. IaaS suits teams that want full control and are willing to handle patching, configuration, and capacity planning.

Platform as a Service (PaaS)

PaaS gives you the capability to deploy your own applications onto a managed platform, using the languages, libraries, and tools the provider supports. The provider runs the underlying infrastructure — servers, operating systems, networking — so you only manage your application and its configuration. Heroku and Render are classic PaaS examples: push your code and the platform runs it. PaaS removes most operations work and suits teams that want to ship applications quickly without managing servers.

Software as a Service (SaaS)

SaaS gives you the provider's applications, running on their infrastructure, accessible from any client device — usually a browser or a programmatic interface. You configure the application for your users but manage none of the infrastructure beneath it. Google Workspace, Microsoft 365, Salesforce, Slack, and Zoom are everyday SaaS. This is the model most non-technical users interact with daily.

In practice the lines blur — most clouds sell all three, and a managed database or a serverless function sits somewhere between IaaS and PaaS.

The four deployment models

Deployment models describe where the cloud infrastructure lives and who uses it.

• Public cloud. Provisioned for open use by the general public. It is owned and operated by a cloud provider — a business, academic, or government organization — and exists on the provider's premises. AWS, Azure, and Google Cloud are public clouds. Anyone can sign up.
• Private cloud. Provisioned for the exclusive use of a single organization with multiple consumers (business units). It may be owned, managed, and operated by the organization itself, a third party, or a mix, and it may live on or off the organization's premises. Private cloud is chosen for control, compliance, or data-residency reasons.
• Community cloud. Provisioned for exclusive use by a specific community of consumers from organizations that share concerns — mission, security requirements, policy, or compliance. It can be owned and operated by one or more of those organizations, a third party, or a combination.
• Hybrid cloud. A composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by technology that enables data and application portability. The classic pattern: keep sensitive workloads in a private cloud and burst to a public cloud for scale.

Serverless and modern extensions

The NIST model was published in 2011 and predates the serverless era. Functions as a Service (FaaS) — AWS Lambda, Cloudflare Workers — and managed services like managed databases or object storage are best understood as extensions of the PaaS idea: the provider manages even more of the stack, and you pay per use instead of per provisioned machine. They still exhibit all five NIST characteristics, so they qualify as cloud; they just sit higher up the managed-services spectrum.

Which one should you use?

There is no universal answer — it depends on your team, your workload, and your constraints:

• You want maximum control over the full stack (custom kernels, specific OS, compliance): IaaS on a public cloud, or a private cloud for strict data residency.
• You want to ship applications fast and avoid managing servers: PaaS. Deploy from Git and let the platform handle operations.
• You want a ready-made product with no infrastructure at all: SaaS. Sign up and configure.
• Your workload is bursty or intermittent: serverless/FaaS, so you pay only for actual execution.
• You need both compliance and scale: hybrid — keep sensitive data in a private or community cloud, expand into public cloud for elasticity.

As a rule of thumb, use the highest level of abstraction that still gives you the control you need: SaaS where a product exists, PaaS for your own applications, IaaS when you need raw infrastructure, and serverless when your workload is event-driven or unpredictable.

FAQ

What is the difference between IaaS, PaaS and SaaS?

IaaS provides raw infrastructure (compute, storage, networking) that you manage yourself; PaaS provides a managed platform where you deploy your own applications without managing servers; SaaS provides complete applications you use directly. They differ in how much of the stack the provider manages — IaaS is the most control and most operations work, SaaS the least of both. Examples: DigitalOcean Droplets (IaaS), Heroku (PaaS), Google Workspace (SaaS).

What are the five characteristics of cloud computing?

The NIST SP 800-145 definition names five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A service that lacks any of these — such as one requiring manual human provisioning, or one with fixed capacity — is not considered cloud in the NIST sense.

What are the four cloud deployment models?

The four NIST deployment models are public cloud (open to the general public, owned by a provider), private cloud (exclusive to one organization), community cloud (exclusive to a group of organizations with shared concerns), and hybrid cloud (a composition of two or more of these, bound together by technology that enables data and application portability).

What is the NIST definition of cloud computing?

NIST SP 800-145 defines cloud computing as "a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction." It is the standard technical definition used by industry and government.