A cloud service provider (CSP) is a company that delivers computing resources over a network on demand. NIST defines three service models: software, platform and infrastructure as a service. The model you buy decides which parts of security the provider handles and which stay with you.
How does NIST define cloud computing?
NIST SP 800-145 gives the reference definition. It lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. It names three service models and four deployment models: private, community, public and hybrid.
A provider that offers these characteristics is a CSP. The rest of the details, such as regions, pricing and product names, are vendor specific and out of scope here.
What do the three service models hand over?
Think of a stack from hardware up to the application. The model decides where your responsibility starts.
Infrastructure as a service (IaaS) gives you virtual machines, storage and networks. The provider runs the data center, hardware and virtualization. You run the operating system, patches, network rules, applications and data.
Platform as a service (PaaS) gives you a runtime or managed database. The provider also runs the operating system and platform. You own your code, configuration and data.
Software as a service (SaaS) gives you a finished application. The provider runs nearly everything. You still own your data, who has accounts, and how they are configured.
A constructed example. A team stores customer exports in an object storage bucket on an IaaS provider. The provider guarantees the storage service is available and that a stolen disk is unreadable. It does not decide the bucket is private. If the team leaves public read on, that is the team's setting and the team's incident.
Why is the line so often misunderstood?
People hear "the provider is secure" and stop there. The provider's attestations, usually independent audits, describe the provider's side. They say little about how any one customer configured their account.
Three gaps recur. Identity and access settings, since the customer creates the users and roles. Data classification and encryption choices, since the customer decides what goes where. And logging, which is often available but off until someone turns it on.
What should you request from a CSP?
- A written description of which controls are the provider's and which are yours, for the exact services you use.
- Independent audit reports or assessments that cover those services and regions. In the United States, FedRAMP lists cloud services that have been authorized for federal use.
- Data location and residency commitments in the contract.
- Incident notification terms: how fast, and to whom.
- Exit terms: how you get your data back in a usable format.
- Logging and API access so you can send audit records to your own tools.
What about deployment models?
NIST also describes how cloud is deployed. A public cloud is open to the general public and owned by the provider. A private cloud is provisioned for one organization, which may run it or have someone else run it. A community cloud serves a defined group with shared concerns, and a hybrid cloud combines two or more of these.
Deployment changes who shares hardware with you and who has physical access, but it does not erase the service model split above. A private cloud on rented hardware still leaves the operating system, access settings and data in the hands of whoever configures them. When you evaluate a provider, ask both questions: what is the deployment, and what is the service model for each product you will use.
How to check or apply this
- Make a one-page table for each cloud service you use, with a column for provider duties and a column for yours.
- Review who holds administrator roles in each account and remove stale ones.
- Check storage, database and network settings against a baseline at least monthly, and after every large change.
- Turn on audit logging for every account and send it somewhere the account's own admins cannot erase.
- Test restore from backup, not only backup creation.
- Re-read the audit report scope whenever you adopt a new service from the same provider. Scope is per service.
Quick check
Is a hosting company a cloud service provider?
Only if it offers the NIST characteristics, such as on-demand self-service and elastic, metered capacity. A fixed rented server does not meet the definition.
If my provider is certified, am I compliant?
Not by that fact alone. The provider's audit covers its own controls. Your configuration, access and data handling still have to meet the framework you answer to.
Sources
Last reviewed: 18 October 2026.
