Classify each cloud service against the four deployment models defined in NIST SP 800-145 Section 4: Private Cloud (the cloud infrastructure is provisioned for exclusive use by a single organisation comprising multiple consumers, may be owned, managed and operated by the organisation, a third party, or some combination, and may exist on or off premises); Community Cloud (the cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organisations that have shared concerns such as mission, security requirements, policy, and compliance considerations); Public Cloud (the cloud infrastructure is provisioned for open use by the general public, may be owned, managed and operated by a business, academic, or government organisation, or some combination, and exists on the premises of the cloud provider); Hybrid Cloud (the cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardised or proprietary technology that enables data and application portability such as cloud bursting for load balancing between clouds). Record ownership, management, location, and tenancy attributes for each service consumed.
This control maps to 35 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 35 it maps to, and the evidence behind each claim, over MCP and REST.