NIST SP 800-145
Deployment Models

NIST SP 800-145 6: Deployment Model Classification (Private, Community, Public, Hybrid)

Classify each cloud service against the four deployment models defined in NIST SP 800-145 Section 4: Private Cloud (the cloud infrastructure is provisioned for exclusive use by a single organisation comprising multiple consumers, may be owned, managed and operated by the organisation, a third party, or some combination, and may exist on or off premises); Community Cloud (the cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organisations that have shared concerns such as mission, security requirements, policy, and compliance considerations); Public Cloud (the cloud infrastructure is provisioned for open use by the general public, may be owned, managed and operated by a business, academic, or government organisation, or some combination, and exists on the premises of the cloud provider); Hybrid Cloud (the cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardised or proprietary technology that enables data and application portability such as cloud bursting for load balancing between clouds). Record ownership, management, location, and tenancy attributes for each service consumed.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 35 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)
  • CPG-1.D Revoking Credentials for Departing Employees
  • CPG-8.A Network Segmentation

ISO/IEC 27011:2024 · 2 controls

  • 27011-6.3 Awareness and Training
  • 27011-8.2 Network security and segregation

API 1164 · 1 control

  • API1164-13 Business Continuity and Recovery
  • CAT-D3-1 Preventative controls
  • FFIEC-06 Network security and segmentation

IEC 62443 · 1 control

  • IEC62443-13 Network security monitoring
  • ISO28001-PS-01 Facility Security

ISO/IEC 27010:2015 · 1 control

  • 27010-13.1 Communications Security

ISO/IEC 27019:2024 · 1 control

  • ISO27019-13 Network security monitoring

ISO/IEC 27043:2015 · 1 control

  • ISO27043-27 Network security management

ISO/SAE 21434 · 1 control

  • ISO21434-27 Network security management
  • NISTPF-5 Protect-P Access Control (PR.AC-P)
  • NZISM-5 Network Security, System Hardening, and Application Security

OWASP ASVS · 1 control

OWASP MASVS · 1 control

South Korea ISMS-P · 1 control

  • ISMSP-AC-04 Network Access Control
  • CPSC-CS.1 Network Security for Connected Products
  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 35 it maps to, and the evidence behind each claim, over MCP and REST.