2.1 Cloud Definition, Essential Characteristics & ISO/IEC Standards

2.1 Cloud Definition, Essential Characteristics & ISO/IEC Standards

Quick Answer: NIST SP 800-145 describes cloud computing through five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. The current ISO cloud vocabulary and reference architecture are in the ISO/IEC 22123 family. The older ISO/IEC 17788 and 17789 publications are withdrawn predecessors. Cloud can shift selected capital costs toward usage-based operating expense, but commitments, accounting treatment, and total cost remain workload and contract specific.

---

The Formal Definition of Cloud Computing

The most widely recognized and authoritative definition of cloud computing in enterprise security and the CCSK v5 body of knowledge comes from the United States National Institute of Standards and Technology (NIST Special Publication 800-145):

"Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction."

This definition establishes that cloud computing is not an evolutionary iteration of hardware, but an operational and architectural model. It separates the consumer from the physical realities of data center management through automated abstraction, multi-tenant resource sharing, and metered consumption.

---

The 5 NIST Essential Characteristics

To be classified as authentic cloud computing under CSA Guidance v5 and NIST SP 800-145, an IT environment must exhibit all five of the following characteristics. If even one characteristic is absent, the environment does not qualify as cloud computing.

Deep-Dive: Resource Pooling and Location Independence

Resource pooling relies fundamentally on multi-tenancy—the architectural approach where a single physical infrastructure stack serves multiple disparate customers (tenants). Software abstraction layers isolate each tenant's memory, compute cycles, network packets, and disk sectors to prevent data leakage between tenants.

A critical sub-concept of resource pooling is location independence. The consumer generally has no control or knowledge over the exact physical location of the provided resources (such as the specific server chassis, rack position, or storage array). However, consumers can specify location at higher, logical levels of abstraction, including:

• Geopolitical Boundary / Country: Meeting an organization's assessed residency, sovereignty, contractual, or sector requirements. GDPR and HIPAA do not impose one universal country-of-storage rule for every workload.
• Region: A separate geographic area (e.g., us-east-1, eu-west-1) containing multiple isolated data center complexes.
• Availability Zone (AZ): One or more discrete data centers with redundant power, networking, and cooling within a single region, engineered to isolate infrastructure failures.

[!WARNING] The "Noisy Neighbor" Risk in Resource Pooling: In a multi-tenant shared hardware environment, one tenant running aggressive computational jobs or heavy I/O operations can inadvertently degrade performance for adjacent tenants sharing the same physical host CPU bus or network switch. Modern hypervisors mitigate this using strict hypervisor CPU throttling, Quality of Service (QoS) bandwidth ceilings, and dedicated hardware cores.

Deep-Dive: Rapid Elasticity vs. Scalability

CCSK candidates must not conflate elasticity with scalability:

• Scalability: The capacity of an architectural system to handle growing workloads by adding resources (scaling up vertically with larger hardware, or scaling out horizontally with more nodes).
• Rapid Elasticity: The ability to provision and release capacity quickly—often automatically—so resources can scale out and in with demand. Scaling behavior, minimum capacity, and idle charges depend on the service.

---

Current ISO/IEC Cloud Vocabulary and Reference Architecture

The current ISO cloud-computing family includes:

• ISO/IEC 22123-1:2023 — Vocabulary: defines current cloud-computing terms.
• ISO/IEC 22123-2:2023 — Concepts: describes cloud concepts and relationships.
• ISO/IEC 22123-3:2023 — Reference Architecture: describes cloud roles, functional components, and architectural views.

Older material may cite ISO/IEC 17788:2014 for overview and vocabulary and ISO/IEC 17789:2014 for the cloud reference architecture. ISO lists both as withdrawn and replaced by the ISO/IEC 22123 family. This distinction matters when a question asks for a historical CCSK term versus when an operating program needs a current standard.

The reference architecture distinguishes cloud service customer, provider, and partner roles and helps map functions such as service management, resource orchestration, security, and business support. It does not by itself assign every security control; service documentation, contract, deployment model, and configuration define the operating boundary.

---

Economic Foundations: CapEx, OpEx & TCO

The migration from legacy on-premises data centers to cloud computing fundamentally alters an enterprise's financial and accounting framework.

Capital Expenditures (CapEx) vs. Operational Expenditures (OpEx)

+-----------------------------------------------------------------------------------+
|  TRADITIONAL IT (CapEx Dominant)                                                  |
|  [Buy Data Center] -> [Buy Servers & SAN] -> [3-5 Year Fixed Depreciation Schedule] |
|  Capacity must be oversized to absorb multi-year peak loads -> High Idle Waste    |
+-----------------------------------------------------------------------------------+
                                          vs.
+-----------------------------------------------------------------------------------+
|  CLOUD COMPUTING (OpEx Dominant)                                                  |
|  [Provider-Owned Hardware] -> [Usage, subscription, or commitment pricing]       |
|  Elastic capacity can reduce waste when architecture and operations release it    |
+-----------------------------------------------------------------------------------+

Economies of Scale in Cloud Operations

Cloud Service Providers achieve staggering economies of scale that individual enterprises cannot match:

• Bulk Purchasing Power: CSPs purchase commodity chips, memory, and custom server chassis by the hundreds of thousands directly from manufacturers at deep wholesale discounts.
• Power and Cooling Efficiency: Large providers can optimize facilities at scale, but efficiency varies by facility, climate, utilization, and measurement method.
• Custom Silicon: Hyperscalers design proprietary silicon (e.g., custom ARM processors, cryptographic offload ASICs, TPU/NPU machine learning chips) that drastically cut power consumption per compute unit.
• Operational Automation: Large providers automate provisioning, repair, monitoring, and fleet management across very large estates, reducing per-resource operating effort.

Total Cost of Ownership (TCO) Calculations and Traps

Calculating Total Cost of Ownership (TCO) in cloud requires accounting for both direct and indirect costs:

• Direct Costs: Hardware purchase price, server maintenance contracts, software licensing, electricity, real estate lease, physical fiber bandwidth, and cooling maintenance.
• Indirect Costs: Data center physical security personnel, disaster recovery site upkeep, downtime costs during power failures, and the opportunity cost of slow application delivery.

[!IMPORTANT] The Cloud Waste and Egress Cost Trap: Migrating to cloud does not guarantee lower TCO. Organizations that perform simple "lift-and-shift" migrations without refactoring for rapid elasticity often pay more in cloud. Common pitfalls include leaving non-production environments running 24/7, failing to release unattached storage volumes ("zombie volumes"), over-sizing instance sizes, and failing to monitor data egress fees (charges incurred when transferring data out of the provider's network).