Cloud computing

The reference definition is still NIST SP 800-145 (Mell and Grance, September 2011): five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models (IaaS, PaaS, SaaS) and four deployment models (public, private, community, hybrid). ISO/IEC 17788:2014 gives a comparable vocabulary. The definition is deliberately technology-neutral and works as a test: a server rented by the month and set up through support tickets fails self-service and elasticity, so it is hosting or outsourcing rather than cloud in the NIST sense. Later labels such as serverless/FaaS, containers-as-a-service and DBaaS refine the three service models rather than replace them.

Resource pooling rests on virtualisation (hypervisors with hardware-assisted nested paging, software-defined overlay networks such as VXLAN) and on a control plane exposed as an authenticated API. Every console click is an API call signed with credentials (for example AWS Signature Version 4), authorised by the provider's IAM and recorded in an audit trail such as AWS CloudTrail, Azure Activity Log or Google Cloud Audit Logs. The split between control plane and data plane is the central security property: whoever holds control-plane credentials can snapshot disks, open network rules or delete backups without ever touching the workload itself. Elasticity is implemented by autoscaling against metrics, and measured service by per-second or per-request metering.

The failure modes differ from on-premises operation. Availability zones are isolated failure domains inside a region, so surviving the loss of a whole region requires an explicit multi-region design. Multi-tenancy adds cross-tenant side-channel risk (the Spectre/Meltdown class disclosed in 2018), and elasticity adds cost runaway, typically cryptomining on stolen credentials. Egress fees and proprietary managed services create lock-in; the EU Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, imposes switching obligations on providers of data processing services and phases out switching charges entirely from 12 January 2027.

Legally, a provider processing personal data on the customer's instructions is a processor under GDPR Art. 28, which requires a data processing agreement; transfers to third countries fall under Chapter V, shaped by the Schrems II judgment (C-311/18, July 2020) and the EU-US Data Privacy Framework adequacy decision of July 2023. Cloud computing service providers are themselves listed under digital infrastructure in NIS2 Annex I. Cloud computing should be kept distinct from virtualisation, which is an enabling technology, and from the shared responsibility model, which describes how operating duties are split once the service is bought.