NIST
In brief
The US standards agency. It was this body that, in 2011, established the benchmark definition of what the ‘cloud’ actually is.
▶ Precise definition
The National Institute of Standards and Technology, a US federal agency under the Department of Commerce. Its publication SP 800-145 (2011) establishes the global definition of cloud computing based on five cumulative criteria: on-demand self-service, broad network access, resource sharing, rapid elasticity and metered service. A service that does not meet all five criteria is not cloud computing in the strict sense, but rather hosting or managed services. The definition remains the benchmark in 2026; no official revision of SP 800-145 has replaced it as of that date.
Our analysis
NIST, the National Institute of Standards and Technology, is the US federal standards agency, which reports to the Department of Commerce. Its role extends beyond information technology: it sets measurement and reference standards across a wide range of fields. In the field of cloud computing, its contribution lies in a short and precise document, Special Publication SP 800-145, published in 2011.
This publication resolved a debate that the market had previously left in a state of uncertainty. Before it, everyone used the term ‘cloud’ to refer to pretty much whatever they wanted to sell. SP 800-145 establishes a clear definition: cloud computing is based on five criteria that must all be met. On-demand self-service, where the customer provisions their own resources without human intervention from the provider. Broad network access, where resources are available via standard mechanisms. Shared infrastructure, where a single physical infrastructure serves multiple customers. Rapid elasticity, where capacity scales up and down in near real time. Metered service: usage is measured and billed on a pay-as-you-go basis.
This definition has become the global benchmark, adopted well beyond the United States, because it is neutral and verifiable. It does not describe a product; it describes a delivery model. This is what makes it useful for sorting through offers: a service that does not tick all five boxes falls into a different category—such as dedicated hosting or managed services—even if the word ‘cloud’ appears in the brochure.
When it comes to sovereignty, this framework changes the conversation. The contract is not the same depending on whether you are renting a flexible connection billed on a pay-as-you-go basis or a machine on a monthly basis. Dependency, reversibility and the applicable law are not framed in the same terms. Checking that an offer actually meets all five NIST criteria means knowing exactly what we are talking about before discussing who controls it. Note on a possible ‘version 2’: to date, no official revision of SP 800-145 has been published by NIST to replace the 2011 text, which remains the current reference.
See also