The Real Standards Behind Cloud Computing: NIST SP 800-145, CSA, ISO/IEC 17788, and CNCF
“Cloud computing” is defined by an actual government standard, not just a marketing term, and knowing the real bodies behind cloud architecture, security, and portability helps cut through vendor-specific claims when you’re evaluating Azure, OCI, AWS, or anything else. Here is the real reference layer.
The formal definition everything else builds on
NIST SP 800-145, “The NIST Definition of Cloud Computing,” is the two-page document that formally defines the five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models (IaaS, PaaS, SaaS), and four deployment models (private, public, hybrid, community) that every cloud provider’s marketing language ultimately maps back to. It’s short, free, and worth actually reading once.
Cloud-specific security standards
- Cloud Security Alliance (CSA): publishes the Cloud Controls Matrix (CCM), a cybersecurity control framework specifically mapped to cloud computing, widely used as the basis for vendor security questionnaires and cloud-specific risk assessments.
- ISO/IEC 27017: extends the general ISO/IEC 27001/27002 information security controls with guidance specific to cloud service providers and cloud customers.
- ISO/IEC 17788: the formal international vocabulary and overview standard for cloud computing, the ISO-side counterpart to NIST SP 800-145.
The organization behind modern cloud-native infrastructure
The Cloud Native Computing Foundation (CNCF), part of the Linux Foundation, governs Kubernetes and a large ecosystem of related projects (Prometheus, containerd, Envoy) that define what “cloud native” actually means as a technical architecture rather than just a buzzword. If your workloads run in containers orchestrated by Kubernetes on any of the major clouds, you’re operating inside a CNCF-governed ecosystem regardless of which vendor’s managed Kubernetes service you use.
Systems and infrastructure management standards
DMTF (Distributed Management Task Force) maintains several standards relevant to cloud infrastructure management, including Redfish for hardware management (relevant to the physical layer underneath private and hybrid clouds) and the Common Information Model for describing manageable resources in a vendor-neutral way.
Why this matters when comparing providers
When a cloud provider claims a service is “compliant” or “cloud native,” these are the actual documents that claim is measured against. A provider with a genuine SOC 2 report or ISO/IEC 27017 certification has been independently audited against a specific, named standard, which is meaningfully different from a marketing page asserting “enterprise-grade security” with nothing to verify it against.
Frequently asked questions
Is NIST SP 800-145 still the current definition, or has it been updated for newer cloud models like serverless?
SP 800-145 itself has not been revised since its original 2011 publication, and it remains the standard reference definition. Newer models like serverless/Function-as-a-Service are generally understood as falling within the existing PaaS category rather than requiring a new formal NIST definition, though industry usage of the term has evolved faster than the formal document.
Do I need to care about CNCF governance if I just use a managed Kubernetes service and never touch the underlying infrastructure?
Not for day-to-day operation, but it matters when evaluating portability. Because Kubernetes itself is a CNCF-governed open standard rather than a single vendor’s proprietary product, workloads built against it are meaningfully more portable between cloud providers than workloads built against a vendor-specific proprietary orchestration layer, which is worth factoring into architecture decisions if avoiding vendor lock-in matters to you.
