Cloud computing explained properly starts with a definition, not a vendor logo. NIST defines the model in SP 800-145, and the definition still holds. Cloud computing means on-demand access to shared computing resources, set up without human handoffs and metered by use. Five traits, three service models and four deployment models make up the whole scheme. The money follows the meter.
The definition matters because it separates renting from owning. A server in a closet is not cloud, no matter what the invoice says. A rented virtual machine with a dashboard and hourly billing is. The traits draw that line, and auditors lean on them.
Cloud Computing Explained by NIST
NIST published the definition in 2011, and it still anchors federal policy. The five traits are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. Each trait earns its place. Self-service removes the ticket queue. Pooling spreads cost across tenants. Elasticity matches capacity to load. Measured service makes the bill real.
Broad network access means the service rides standard links. A browser or an API call is enough to reach it. Skip one trait and the offer is something else. A hosted server that needs a sales call to resize fails self-service. That failure mode has a price, and it shows up during the next traffic spike.
The Three Service Models
The service models stack like floors. Infrastructure as a Service rents raw compute, storage and network. Platform as a Service rents the runtime and the tooling around it. Software as a Service rents the finished application, seat by seat. NIST names all three in SP 800-145.
The trade is control against chores. Lower floors demand more skill but grant more room. Higher floors remove patching and capacity work, at the cost of a narrower set of choices. Security duties also split by floor. The provider patches what it runs, and the tenant still owns its data and its logins. Multi-tenant design spreads the base cost thin, which is why the floors price so differently.
The Four Deployment Models
Deployment models say who shares the pool. Public cloud serves many tenants on shared hardware. Private cloud serves one organization, on site or rented. Community cloud serves a group with shared rules. Hybrid cloud stitches two models together with real data links.
The word private confuses buyers. A private cloud still needs the five traits, including self-service. A locked-down rack with a ticket queue is old hosting wearing new labels. Regulated workloads often start in private or community pools, then stretch into public capacity for burst work.
The Money: Metered Use and Commitments
The pricing turns capacity into an operating cost. Pay per hour or per seat, and stop paying when the workload stops. SaaS Capital surveys private software firms each year. Its 2026 survey put median growth at 22 percent, down from 25 percent the year before. Subscription money now moves the whole stack. This connects to our earlier piece, Cybersecurity Salary: What Moves the Number, Role by Role.
Commitments complicate the meter. Providers discount long-term volume deals, and finance teams love a discount. The risk lands as stranded capacity when demand shifts. Read provider finances the way the SEC beginner guide suggests, with footnotes in view. The guide also notes that no single statement tells the whole story, which fits cloud billing well. Metered freedom and committed discounts pull in opposite directions, and the bill tells the truth. For related coverage, see NYDFS Cyber Guidance Pushes Vendors, AI and Quantum Into Risk Assessments.
Conclusion: The Definition Test
That is cloud computing explained in one pass: the traits, the floors, the pools and the meter. Run every cloud offer against the NIST traits. Name the service model floor and the deployment model. Then ask what an exit costs, in transfer fees and migration months. A provider that answers plainly passes. One that changes the subject fails the definition test.
