Special Publication 500-293 (Draft) US Government Cloud Computin.docx

Special Publication 500-293 (Draft)
US Government Cloud Computing Technology Roadmap
Volume II Release 1.0 (Draft)
Useful Information for Cloud Adopters
Lee Badger, Robert Bohn, Shilong Chu, Mike Hogan, Fang Liu,
Viktor Kaufmann, Jian Mao, John Messina, Kevin Mills, Annie
Sokol, Jin Tong, Fred Whiteside and Dawn Leaf
NIST Cloud Computing Program Information Technology
Laboratory
This page left intentionally blank
NIST Special Publication 500-293 (Draft)
US Government Cloud Computing Technology Roadmap
Volume II Release 1.0 (Draft)
Useful Information for Cloud Adopters
Lee Badger, Robert Bohn, Shilong Chu, Mike Hogan, Fang Liu,
Viktor Kaufmann, Jian Mao, John Messina, Kevin Mills, Annie
Sokol, Jin Tong, Fred Whiteside and Dawn Leaf
Information Technology Laboratory
Cloud Computing Program Information Technology Laboratory
National Institute of Standards and Technology Gaithersburg,
MD 20899
November 2011
U.S. Department of Commerce
John E. Bryson, Secretary
National Institute of Standards and Technology
Patrick D. Gallagher, Under Secretary for Standards and
Technology and Director
NIST SP 500-293 NIST US Government Cloud Computing
Technology Roadmap, Release 1.0 (Draft)
NIST US Government Cloud Computing Technology Roadmap,
Volume II, Release 1.0 (Draft) November 2011
Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National
Institute of Standards and Technology (NIST) promotes the U.S.

economy and public welfare by providing technical leadership
for the nation’s measurement and standards infrastructure. ITL
develops tests, test methods, reference data, proof of concept
implementations, and technical analysis to advance the
development and productive use of information technology.
This Special Publication 500-series reports on ITL’s research,
guidance, and outreach efforts in Information Technology and
its collaborative activities with industry, government, and
academic organizations.
National Institute of Standards and Technology Special
Publication 500-293 (Draft) Natl. Inst. Stand. Technol. Spec.
Publ. 500-293, 85 pages (November 2011)
Certain commercial entities, equipment, or materials may be
identified in this document in order to describe an experimental
procedure or concept adequately. Such identification is not
intended to imply recommendation or endorsement by the
National Institute of Standards and Technology, nor is it
intended to imply that the entities, materials, or equipment are
necessarily the best available for the purpose.
Acknowledgments
The authors, Shilong Chu, Fang Liu, Viktor Kaufmann, Jian
Mao, and Jin Tong, of Knowcean Consulting Incorporated
(under contract through the Federal Integrated Product Team,
Space & Naval Warfare (SPAWAR) Systems Center Atlantic,
Lee Badger, Robert Bohn, Mike Hogan, John Messina, Kevin
Mills, Annie Sokol, Fred Whiteside and Dawn Leaf of the
National Institute of Standards and Technology (NIST),
gratefully acknowledge and appreciate the broad contributions
from members of the NIST Cloud Computing US Government
Target Business Use Case, Reference Architecture and
Taxonomy, Standards Acceleration to Jumpstart the Adoption of
Cloud Computing (SAJACC), Security, and Standards Roadmap

Working Groups.
We especially acknowledge Carolyn French, Romayne Hines,
Michaela Iorga, Elizabeth Lennon, and Peter Mell of NIST for
providing technical input and detailed editorial support.
Appendix A presents an extended list of contributors that
participated and contributed to NIST public working groups.
Appendix B lists references that were consulted in the
development of this document. Additional acknowledgments
will be added upon the final publication of this guideline.
Table of Contents
Executive Summary
...............................................................................................
..................................... 11
1
2
Introduction
...............................................................................................
......................................... 13
1. 1.1 NIST Cloud Computing Program Background
........................................................................... 13
2. 1.2 NIST Cloud Computing Program
Vision....................................................................................
13
3. 1.3 Intended Audience and Use
.......................................................................................... .....
......... 14
4. 1.4 Document Organization
...............................................................................................
............... 14
NIST Cloud Computing Definition and Reference Architecture
....................................................... 16
1. 2.1 Revisiting the

Definition...............................................................................
..............................16
2. 2.2 NIST Cloud Computing Reference
Architecture........................................................................18
1. 2.2.1 Conceptual Model
...............................................................................................
.................. 19
2. 2.2.2 Cloud Computing Actors
...............................................................................................
....... 19
3. 2.2.3 Architecture
Components............................................................................
.......................... 23
2.3 NIST Cloud Computing
Taxonomy...............................................................................
............. 24 Cloud Computing Use Cases and
Requirements..........................................................................
...... 26 3.1 Target Business Use Case and High-Level
Requirements..........................................................26
1. 3.1.1 Business Use Case
Template.................................................................................
................ 28
Summaries..............................................................................
................ 28
Analysis..................................................................................
................ 31
3.2 SAJACC Use Cases and Technical
Requirements...................................................................... 44
Cloud Computing Standards and Gap Analysis
................................................................................. 46
1. 4.1 Cloud Computing Standards
...............................................................................................
........ 46
2. 4.2 Cloud Computing Standards Gaps and USG

Priorities............................................................... 47
3. 4.3 Accelerating the Development and the Use of Cloud
Computing Standards ............................. 48
High-Priority Security
Requirements..........................................................................
.......................49 5.1 Understanding Security in the Cloud
Context ............................................................................ 50
1. 5.1.1 Cloud Service Model
Perspectives............................................................................
............ 50
2. 5.1.2 Implications of Cloud Deployment Models
.......................................................................... 50
3. 5.1.3 Shared Security Responsibilities
...........................................................................................
50
4. 5.1.4 Developing Security Architecture for Cloud Systems
.......................................................... 51
3
4
5
6
7
2. 5.2 Challenging Security Requirements and Risk Mitigations
......................................................... 51
3. 5.3 Process-Oriented
Requirements..........................................................................
........................52
1. 5.3.1 Application of NIST SP 800-53-style Controls and
Compliance ......................................... 52
2. 5.3.2 Cloud Audit Assurance and Log Sensitivity
Management ................................................... 53
3. 5.3.3 Cloud Certification and Accreditation Guidelines
................................................................ 56
4. 5.3.4 Clear eDiscovery

Guidelines...............................................................................
.................. 56
5. 5.3.5 Cloud Privacy
Guidelines...............................................................................
....................... 57
6. 5.3.6 Clarified Security Control Roles and
Responsibilities..........................................................59
7. 5.3.7 Trustworthiness of Cloud Operators
..................................................................................... 59
8. 5.3.8 Business Continuity and Disaster Recovery
......................................................................... 60
5.4 Focused Technical Requirements
...............................................................................................
61
1. 5.4.1 Technical Continuous Monitoring Capabilities
.................................................................... 62
2. 5.4.2 Visibility for Customers
...............................................................................................
......... 63
3. 5.4.3 Control for Customers
...............................................................................................
............ 63
4. 5.4.4 Data Protection
Concerns.................................................................................
..................... 65
5. 5.4.5 Risk of Account Compromise
...............................................................................................
66
6. 5.4.6 Identity and Access Management (IAM) and
Authorization ................................................ 67
7. 5.4.7 Multi-tenancy Risks and Concerns
....................................................................................... 69
8. 5.4.8 Cloud-Based Denial of Service
.............................................................................................
70
9. 5.4.9 Incident Response

...............................................................................................
.................. 71
Other Related Work
...............................................................................................
............................ 72 6.1 Cloud Data Issues
...............................................................................................
........................ 72
1. 6.1.1 Operational Data
Functions................................................................................
................... 72
2. 6.1.2 Informational Data and Data Services
.................................................................................. 74
2. 6.2 Service-Level Agreement Taxonomy
......................................................................................... 75
3. 6.3 Reliability Research in Cloud-based Complex Systems
............................................................. 77
Summary and Next Steps
...............................................................................................
.................... 78
Appendix A. USG Federal Cloud Computing Standards Working
Group Members and Interagency, Academic, Standards
Organizations, and Industry Contributors
................................................................ 79
Appendix B. Useful References
...............................................................................................
.............. 83
Release 1.0 (Draft) November 2011
Executive Summary
The first release of the Special Publication 500-293, United
States Government USG Cloud Computing Technology
Roadmap document consists of two volumes. Consistent with
the NIST Cloud Computing program strategy, the roadmap
focuses on both strategic and tactical objectives related to cloud

computing.
Volume I, High-Priority Requirements to Further USG Cloud
Computing Adoption, frames the discussion and introduces the
roadmap in terms of summarized strategic requirements that
must be met for USG agencies to further cloud adoption. The
roadmap strategic elements can be characterized as “high-
priority technical areas” which are enablers for cloud computing
in both the short and long term.
Volume II, Useful Information for Cloud Adopters, provides
information for those actively working on strategic and tactical
cloud computing initiatives, including but not limited to,
government cloud adopters.
This volume presents a summary of the work completed from
November 2010 through September 2011 through the NIST
Cloud Computing program and collaborative effort to develop a
USG Cloud Computing Technology Roadmap.
This document presents a representative sample of the work that
was completed and documented through this effort. Additional
working documents, special publications, meeting and other
collaboration artifacts can be found on the NIST Cloud
Computing Web site http://www.nist.gov/itl/cloud/index.cfm.
Volume II:
Introduces a conceptual model, the NIST Cloud Computing
Reference Architecture and Taxonomy;
Presents USG target business use cases and technical use
cases in the cloud;
Identifies existing interoperability, portability, and security
standards that are applicable to the cloud
computing model and specifies high-priority gaps for which new
or revised standards, guidance, and
technology need to be developed;
Discusses security challenges in the context of cloud
computing adoption, high-priority security
requirements, and current and future risk mitigation measures
requirements; and
Provides insight into the rationale for the list of candidate

Priority Action Plans (PAPs) recommended
for voluntary self-tasking by government and private sector
organizations, listed in Volume I.
The document presents a subset of the analysis that drove the
rationale for the requirements introduced in Volume I of this
NIST Special Publication, titled High-Priority Requirements to
Further USG Agency Cloud Computing Adoption.
The following Figure 1 shows the relationship between the
high-priority requirements in Volume I and the key NIST-led
activities and contributing sources that are summarized here in
Volume II.
Page 11
Requirement 1: International voluntary consensus based
interoperability, portability and security standards
X
X
X
Requirement 2:
Solution
s for high priority security requirements
X
X
X

X
X
Requirement3: Technical specifications for high quality service
level agreements
X
X
X
Requirement4: Clear& consistently categorized cloud services
X
Requirement 5: Frameworks to support federated community
clouds
X

X
X
Requirement6: Technical security solutions de-coupled from
organizational policy
X
Requirement 7: Defined unique government requirements and
solutions
X
X
X
Requirement8: Collaborative parallel “future cloud”
development initiatives

X
Requirement 9: Defined & implemented reliability design goals
X
X
X
X
Requirement 10: Defined & implemented cloud service metrics
X
X
X
X
Figure 1: Relationship between Volume I Requirements and
Work Presented in Volume II
Page 12

Cloud Computing Standards Roadmap Working Group
Cloud Computing Reference Architecture and Taxonomy
Working Group
Cloud Computing Security Working Group
Cloud Computing Target USG Business Use Cases Working
Group
Standards Acceleration to Jumpstart the Adoption of Cloud
Computing
NIST Speciali Publications: 800-125 Security for Virtualization,
800-144 Guidelines for Security
and Privacy in Cloud Computing, 800-146 Cloud Computing
Synopsis and Recommendations
NIST Complex Information System Measurement Project:
Koala, IaaS Computing Simulation
Model
1 Introduction
1.1 NIST Cloud Computing Program Background
The National Institute of Standards and Technology plays a
technology leadership role in accelerating the federal
government’s secure adoption of cloud computing. In this role,
NIST, in close consultation and collaboration with standards
bodies, the private sector, and other stakeholders, is leading the
efforts to develop the necessary standards and guidelines that

will facilitate the secure, rapid adoption of cloud computing.
The NIST Cloud Computing Program was formally launched in
November 2010, and supports the US federal government effort
to incorporate cloud computing, where appropriate, as a
replacement for, or enhancement of, the traditional information
systems and application models. The NIST Cloud Computing
Program operates in coordination with other federal cloud
computing efforts and is integrated within the Federal Cloud
Computing Strategy.1
For more information regarding the program’s scope and
objectives, the reader is referred to Volume I of this NIST
Special Publication 500-293: High-Priority Requirements to
Further USG Agency Cloud Computing Adoption.
In order to leverage the expertise of the broad cloud computing
stakeholder community, NIST has established the following
Public Working Groups:
Working Group
Cloud Computing Target Business Use Cases Working
Group
Cloud Computing SAJACC Technical Use Cases Working
Group
Cloud Computing Standards Roadmap Working Group
Cloud Computing Security Working Group
The groups are listed in the same sequence that their respective

subject matter is presented in this
document. The order does not imply priority or chronological
sequencing.
1.2 NIST Cloud Computing Program Vision
NIST seeks to provide thought leadership and guidance around
the cloud computing model to catalyze its use within industry
and government, and to shorten the adoption cycle, which will
enable near-term cost savings and increased ability to quickly
create and deploy safe and secure enterprise solutions.
Additionally, NIST is committed to fostering cloud computing
practices that support interoperability, portability, and security
requirements that are appropriate and achievable for various
usage scenarios, by focusing on the necessary standards,
specifications, and guidance that must be in place for these
requirements to be met.
The first release of the USG Cloud Computing Technology
Roadmap is presented as a two-volume NIST Special
Publication 500-293 document. The process and document
together are the mechanism used to define and communicate the
high-priority USG interoperability, portability, and security
requirements for cloud computing, and to identify the necessary
associated standards, guidance, and technology.
1 Office of Management and Budget, U.S. Chief Information
Officer, Federal Cloud Computing Strategy, Feb. 8, 2011.
Online: www.cio.gov/documents/Federal-Cloud-Computing-

Strategy.pdf.
Page 13
This document, Volume II of the Special Publication, focuses
on work that helped to identify the USG high-priority
interoperability, portability, and security requirements which
are introduced in Volume I and summarizes work in the
following areas:
Introduction of an overall cloud computing conceptual
model in the form of the NIST Cloud Computing Reference
Architecture and Taxonomy. This technical reference can be
used to understand, discuss, categorize, and compare different
cloud service offerings, and to facilitate the communication and
analysis of the security, interoperability, and portability
candidate standards and reference implementations.
Presentation of a template and an initial set of USG target
business and technical use cases that describe how government
agencies seek to use cloud computing, and presentation of key,
specific technical requirements that surfaced through these use
cases.
Identification of existing interoperability, portability, and
security standards and guidance that are applicable to the cloud
computing model, and identification of high-priority gaps for
which new or revised standards, guidance, and technology need

to be developed.
Identification of the high-priority security requirements that
challenge the adoption of cloud computing and presentation of
proposed mitigation strategies.
Discussion of considerations and activities related to cloud
Service-Level Agreements (SLAs).
1.3 Intended Audience and Use
This publication is intended for a diverse audience:
1.4
US Policy Makers, US Federal CIO Council, and those with
identified key roles identified in the Federal Cloud Computing
Strategy – as a technology-oriented reference to inform policy
and planning.
USG Agencies – as a useful tool in the context of the USG
Federal Cloud Computing Strategy risk-based management
decision framework.
Cloud Computing Stakeholders (Academia, Government,
Industry, Standards Developing Organizations) – as a
consolidated presentation of USG cloud computing technology
perspectives and work, including a unifying cloud computing
reference model, a set of documented technical requirements,
and a list of identified gaps in standards, guidance, and
technology.

Document Organization
Consistent with the NIST Cloud Computing program strategy,
the roadmap focuses on both strategic and tactical objectives
related to cloud computing. The strategic roadmap elements can
be characterized as “high-priority technical areas” which are
enablers for cloud computing in both the short and long term.
The tactical work not only supports strategic goals, but is
intended to support cloud adopters in the interim deployment
period as the cloud computing model is maturing.
This initial release of the roadmap special publication consists
of two volumes.
Volume I is aimed at interested parties who wish to gain a
general understanding and overview of the background,
purpose, context, work, results, and next steps of the USG
Cloud Computing Technology Roadmap initiative. Volume I
reflects the collective inputs of USG agencies through the
Federal CIO Council-sponsored Cloud Computing Standards and
Technology Working Group.
Page 14
Volume I, High-Priority Requirements to Further USG Cloud
Computing Adoption, frames the discussion and introduces the
roadmap in terms of:
Prioritized strategic and tactical requirements that must be

met for USG agencies to further cloud adoption;
Interoperability, portability, and security standards,
guidelines, and technology that must be in place to satisfy these
requirements; and
Recommended list of Priority Action Plans (PAPs) as
candidates for development and implementation, through
voluntary self-tasking by the cloud computing stakeholder
community, to support standards, guidelines, and technology
development.
This volume, Volume II, Useful Information for Cloud
Adopters, is designed to be useful at the tactical level to those
actively working on cloud computing initiatives, including but
not limited to, US government cloud adopters. Volume II
summarizes the work completed to date, explains the assessment
findings based on this work, and highlights how these findings
support the key requirements in the roadmap introduced in
Volume I.
The Executive Summary of this volume includes a chart that
shows the correlation between the set of high-priority USG
requirements presented in Volume I, and the NIST projects and
public working group efforts and findings summarized in
Volume II.
The remainder of Volume II is organized into the following
sections: Section 2 presents the NIST cloud computing
definition and reference architecture. Section 3 presents USG

cloud computing requirements through business use cases and
technical use cases. Section 4 summarizes cloud computing
technology standards and gap analysis. Section 5 discusses
cloud computing security and presents a list of security
impediments and corresponding mitigations.
A third volume, Technical Considerations for USG Cloud
Computing Deployment Decisions, is under development, and in
keeping with the NIST transparent and collaborative process, is
currently available as a working document. Volume III is being
developed as an interagency project through the Federal Cloud
Computing Standards and Technology Working Group, and will
leverage the NIST-led cloud computing program public working
group process. Volume III is intended to serve as a guide for
decision makers who are planning and implementing cloud
computing solutions by explaining how the technical work and
resources in Volume II can be applied, consistent with the
Federal Cloud Computing Strategy “Decision Framework for
Cloud Migration.” The current version of the working document
defines and proposes a methodology for defining a
representative sample of common cloud computing planning and
deployment scenarios, presents the initial candidate set of 12,
presents a process for applying the technical work, and proof-
of-concept examples of how this can be accomplished. Volume
III was initiated in parallel, but is logically dependent on the
technical work contained in Volume II, and will necessarily be

completed and presented as part of the roadmap special
publication in a subsequent release.
The Volume I and Volume II draft special publications, as well
as the working document under development as Volume III, are
publically available through the NIST ITL Cloud Computing
Web site, as are all of the NIST Cloud Computing special
publications and work-in-progress documents,
http://www.nist.gov/itl/cloud/index.cfm.
Page 15
2 NIST Cloud Computing Definition and Reference Architecture
Cloud computing is an emerging computing model which has
evolved as a result of the maturity of underlying prerequisite
technologies. There are differences in perspective as to when a
set of underlying
technologies becomes a “cloud” model. In order to categorize
cloud computing services, and to expect some level of
consistent characteristics to be associated with the services,
cloud adopters need a consistent frame of reference. The NIST
document defines a standard reference architecture and
taxonomy that provide the USG agencies with a common and
consistent frame of reference for comparing cloud services from
different service providers when selecting and deploying cloud

services to support their mission requirements. At a certain
level of abstraction, a cloud adopter does not need to repeatedly
interpret the technical representation of cloud services available
from different vendors. Rather the use of a common reference
architecture by the cloud service providers can be an efficient
tool that ensures consistent categorization of the services
offered.
2.1 Revisiting the Definition
This document uses the NIST SP 800-145, The NIST Cloud
Computing Definition, to explain characteristics of cloud
computing. For the convenience of the reader, the following is
excerpted from NIST SP 800-145:
Cloud computing is a model for enabling convenient, on-
demand network access to a shared pool of configurable
computing resources (e.g., networks, servers, storage,
applications, and services) that can be rapidly provisioned and
released with minimal management effort or service provider
interaction.
This definition lists five essential characteristics that are
common among all cloud computing services:
On-demand self-service: A consumer can unilaterally provision
computing capabilities, such as server time and network
storage, as needed
automatically without requiring human interaction with each
service’s provider.

Highlights: The NIST cloud computing definition identifies
three distinct service models, i.e., Software as a Service,
Platform as a Service, and Infrastructure as a Service.
In late 2010, the NIST Cloud Computing Reference Architecture
project team surveyed and completed an analysis of existing
cloud computing reference models, and developed a vendor-
neutral reference architecture which extends the NIST cloud
computing definition.
This effort leveraged a collaborative process through the NIST
working group. Through a discussion and validation process, the
NIST cloud computing reference architecture project team and
working group analyzed the intricacies of different types of
cloud services and confirmed the need for “Clear and
Consistently Categorized Cloud Services” - NIST USG Cloud
Computing Technology Roadmap Volume I, Requirement 4.
The NIST cloud computing definition and reference architecture
provide a technical basis for discussing “Frameworks to support
federated community clouds” - Volume I, Requirement 5.
The companion NIST cloud computing taxonomy effort has also
identified the need for: “Technical specification for high-quality
service-level agreements” – Volume I, Requirement 3, and
“defined and implemented cloud service metrics” – Volume I,
Requirement 10.
See NIST Special Publication 800-145, The NIST Definition of

Cloud Computing, and NIST Special Publication 500-292, NIST
Cloud Computing Reference Architecture.
Page 16
Broad network access: Capabilities are available over the
network and accessed through standard mechanisms that
promote use by heterogeneous thin or thick client platforms
(e.g., mobile phones, laptops, and personal digital assistants
[PDAs]).
Resource pooling: The provider’s computing resources are
pooled to serve multiple consumers using a multi-tenant model,
with different physical and virtual resources dynamically
assigned and reassigned according to consumer demand. There
is a sense of location independence in that the subscriber
generally has no control or knowledge over the exact location of
the provided resources but may be able to specify location at a
higher level of abstraction (e.g., country, state, or data center).
Examples of resources include storage, processing, memory,
network bandwidth, and virtual machines.
Rapid elasticity: Capabilities can be rapidly and elastically
provisioned, in some cases automatically, to quickly scale out
and rapidly released to quickly scale in. To the consumer, the
capabilities available for provisioning often appear to be
unlimited and can be purchased in any quantity at any time.

Measured Service: Cloud systems automatically control and
optimize resource use by leveraging a metering capability at
some level of abstraction appropriate to the type of service
(e.g., storage, processing, bandwidth, and active user accounts).
Resource usage can be monitored, controlled, and reported,
providing transparency for both the provider and consumer of
the utilized service.
Service Models
Cloud Software as a Service (SaaS): The capability provided to
the consumer to use the provider’s applications running on a
cloud infrastructure. The applications are accessible from
various client devices through a thin client interface such as a
Web browser (e.g., Web-based email). The consumer does not
manage or control the underlying cloud infrastructure including
network, servers, operating systems, storage, or even individual
application capabilities, with the possible exception of limited
user-specific application configuration settings.
Cloud Platform as a Service (PaaS): The capability provided to
the consumer is to deploy onto the cloud infrastructure
consumer-created or acquired applications created using
programming languages and tools supported by the provider.
The consumer does not manage or control the underlying cloud
infrastructure including network, servers, operating systems, or
storage, but has control over the deployed applications and
possibly application hosting environment configurations.

Cloud Infrastructure as a Service (IaaS): The capability
provided to the consumer is to provision processing, storage,
networks, and other fundamental computing resources where the
consumer is able to deploy and run arbitrary software, which
can include operating systems and applications. The consumer
does not manage or control the underlying cloud infrastructure
but has control over the operating systems, storage, deployed
applications, and possibly limited control of select networking
components (e.g., host firewalls).
Deployment Models
Based on how exclusive the cloud infrastructure is operated and
made available to a consumer, cloud services can also be
categorized by a series of deployment models:
Private cloud: The cloud infrastructure is operated solely for an
organization. It may be managed by the organization or a third
party and may exist on-premise or off-premise.
Community cloud: The cloud infrastructure is shared by several
organizations and supports a specific community that has shared
concerns (e.g., mission, security requirements, policy, and
compliance
Page 17
considerations). It may be managed by the organizations or a
third party and may exist on-premise or off- premise.

Public cloud: The cloud infrastructure is made available to the
general public or a large industry group and is owned by an
organization selling cloud services.
Hybrid cloud: The cloud infrastructure is a composition of two
or more clouds (private, community, or public) that remain
unique entities but are bound together by standardized or
proprietary technology that enables data and application
portability (e.g., cloud bursting for load balancing between
clouds).
2.2 NIST Cloud Computing Reference Architecture
The NIST cloud computing reference architecture is a logical
extension to the NIST cloud computing definition. This
extension provides a common frame of reference to help USG
and other cloud computing stakeholders to:
Gain a further understanding of the technical and
operational intricacies of cloud computing;
Communicate cloud consumers’ requirements precisely;
Categorize and compare cloud services objectively; and
Analyze security, interoperability, and portability
requirements systematically in order to better
inform solution implementations.
The reference architecture describes a conceptual model
comprising abstract architectural elements and their relations or
interactions, such as
Cloud computing actors and how they interact with each

other in their activities;
System components and how these components are
orchestrated to deliver the computing services;
Management functionalities that are required to support the
life cycle of operations; and
Other cross-cutting aspects such as security and privacy
associated with these elements.
The reference architecture is a high-level, abstract model not
tied to any specific cloud technology or vendor product, that
focuses on the requirements of “what” cloud services provide
and not on “how to” design and implement these services.
The reference architecture also provides a companion cloud
computing taxonomy detailing the definitions and relationships
of a control vocabulary.
A cloud solution provider may use this reference architecture to
guide the development of real architectures from different
viewpoints (such as application architecture, middleware
architecture, data architecture, and network architecture), given
constraints imposed by the organization’s operational and
technical environments. The reference architecture has a direct
benefit for the cloud consumer as well. By mapping the various
cloud solution products to the architectural components defined
in the reference architecture, a cloud consumer can understand
and compare cloud service offerings and make informed
decisions. For other stakeholders, such as academia and

Standards Developing Organizations (SDOs), the reference
architecture can help frame issues and provide a common
baseline for research.
As described above, the NIST Cloud Computing Reference
Architecture Project Team surveyed and completed an initial
analysis of existing cloud computing reference architectures and
reference models. On this basis, the project team developed a
straw man model of architectural concepts. This effort
leveraged a collaborative process from the NIST Cloud
Computing Reference Architecture and Taxonomy Working
Group, active between November 2010 and April 2011. This
process involved broad
Page 18
participation from the industry, academic, SDOs, and private
and public sector cloud adopters. The project team iteratively
revised the reference model by incorporating comments and
feedback received from the working group. This section
summarizes version 1.0 of the reference architecture and
taxonomy.
2.2.1 Conceptual Model
Figure 2 presents the NIST cloud computing reference
architecture, which identifies the major actors, their activities,
and their functions in cloud computing. The diagram depicts a

generic high-level architecture and is intended to facilitate the
understanding of the requirements, uses, characteristics, and
standards of cloud computing.
Figure 2: The Conceptual Reference Model
2.2.2 Cloud Computing Actors
As shown in Figure 2, the NIST cloud computing reference
architecture defines five major actors: cloud consumer, cloud
provider, cloud carrier, cloud auditor, and cloud broker. Each
actor is an entity (a person or an organization) that participates
in a transaction or process or performs tasks in cloud
computing.
2.2.2.1 Cloud Consumer
The cloud consumer is the principal stakeholder that uses the
cloud computing services. A cloud consumer represents a
person or organization that maintains a business relationship
with, and uses the service from, a cloud provider. A cloud
consumer browses the service catalog from a cloud provider,
requests the appropriate service, sets up service contracts with
the cloud provider, and uses the service. The cloud consumer
may be billed for the service provisioned, and needs to arrange
payments accordingly.
Cloud consumers use Service-Level Agreements (SLAs) for
specifying the technical performance requirements to be
fulfilled by a cloud provider. SLAs can cover terms regarding
the quality of service, security, and remedies for performance

failures. A cloud provider may also list in the SLAs a set of
restrictions or limitations, and obligations that cloud consumers
must accept. In a mature market environment, a cloud consumer
can freely choose a cloud provider with better pricing and more
favorable
Page 19
terms. Typically a cloud provider’s public pricing policy and
SLAs are nonnegotiable, although a cloud consumer who
expects to have heavy usage might be able to negotiate for
better contracts.
SaaS applications are made accessible via a network to the SaaS
consumers. The consumers of SaaS can be organizations that
provide their members with access to software applications, end
users who directly use software applications, or software
application administrators who configure applications for end
users. SaaS consumers can be billed based on the number of end
users, the time of use, the network bandwidth consumed, the
amount of data stored, or the duration of stored data.
PaaS consumers employ the tools and execution resources
provided by cloud providers to develop, test, deploy, and
manage the operation of PaaS applications hosted in a cloud
environment. PaaS consumers can be application developers
who design and implement application software, application

testers who run and test applications in a cloud-based
environment, application deployers who publish applications
into the cloud, and application administrators who configure,
monitor, and manage applications deployed in a cloud. PaaS
consumers can be billed according to the number of PaaS users,
the processing, storage, and network resources consumed by the
PaaS application, and the duration of the platform usage.
IaaS clouds provide cloud consumers with virtual computers,
network-accessible storage, network infrastructure components,
and other fundamental computing resources, on which IaaS
consumers can deploy and run arbitrary software. IaaS can be
used by system developers, system administrators, and IT
managers who are interested in creating, installing, monitoring,
and managing services and applications deployed in an IaaS
cloud. IaaS consumers can be billed according to the amount or
duration of the resources consumed, such as CPU hours used by
virtual computers, volume and duration of data stored, network
bandwidth consumed, or the number of IP addresses used for
certain intervals.
2.2.2.2 Cloud Provider
A cloud provider is the entity (a person or an organization)
responsible for making a service available to interested parties.
A cloud provider acquires and manages the computing
infrastructure required for providing the services, runs the cloud
software that provides the services, and makes the arrangements

to deliver the cloud services to cloud consumers through
network access.
For SaaS, the cloud provider deploys, configures, maintains,
and updates the operation of the software applications on a
cloud infrastructure. The SaaS cloud provider is mostly
responsible for managing the applications, security, and the
cloud infrastructure, while the SaaS cloud consumer has limited
administrative control of the applications.
For PaaS, the cloud provider manages the computing
infrastructure for the platform and runs the cloud software that
provides the components of the platform, such as runtime
software execution stack, databases, and other middleware
components. The PaaS cloud provider typically also supports
the development, deployment, and management process of the
PaaS cloud consumer by providing tools such as integrated
development environments (IDEs), development versions of
cloud software, software development kits (SDKs), and
deployment and management tools. The PaaS cloud consumer
has control over the applications and possibly over some of the
hosting environment settings, but has no or limited access to the
infrastructure underlying the platform such as network, servers,
operating systems (OSs), or storage.
For IaaS, the cloud provider acquires the physical computing
resources underlying the service, including the servers,
networks, storage, and hosting infrastructure. The cloud

provider runs the cloud software necessary to render the
necessary computing resources to the IaaS cloud consumer
through a set of service interfaces and computing resource
abstractions, such as virtual machines and virtual network
interfaces. In return, the IaaS cloud consumer uses these
computing resources, such as a virtual computer,
Page 20
for fundamental computing needs. Compared to SaaS and PaaS
consumers, an IaaS consumer has access to more fundamental
forms of computing resources and thus has control over more
software components in an application stack, including the OS.
The IaaS cloud provider, on the other hand, has control over the
physical hardware and cloud software that make the
provisioning of these infrastructure services possible, for
example, the physical servers, network equipment, storage
devices, host OS, and hypervisor software for virtualization.
A cloud provider’s activities span five major areas including
service deployment, service orchestration, cloud service
management, security, and privacy.
2.2.2.3 Cloud Auditor
A cloud auditor is a party that can perform an independent
examination of cloud service controls with the intent to express
an opinion thereon. Audits are performed to verify conformance

to standards through a review of objective evidence. A cloud
auditor can evaluate the services provided by a cloud provider
such as security controls, privacy impact, and performance.
Auditing is especially important for federal agencies. The
Federal Cloud Computing Strategy document published in
February 2011 pointed out that “agencies should include a
contractual clause enabling third parties to assess security
controls of cloud providers.” Security controls are the
management, operational, and technical safeguards or
countermeasures employed within an organizational information
system to protect the confidentiality, integrity, and availability
of the system and its information. For security auditing, a cloud
auditor can make an assessment of the security controls in the
information system to determine the extent to which the
controls are implemented correctly, operating as intended, and
producing the desired outcome with respect to the security
requirements for the system. The security auditing should also
assess the compliance with the specified regulation and with the
security policy. For example, an auditor can be tasked with
ensuring that the correct policies are applied to data retention
according to relevant rules for the jurisdiction. The auditor may
ensure that fixed content has not been modified and that the
legal and business data archival requirements have been
satisfied.
A privacy impact audit can help federal agencies comply with

applicable privacy laws and regulations governing an
individual’s privacy, and to ensure confidentiality, integrity,
and availability of an individual’s personal information at every
stage of development and operation.
2.2.2.4 Cloud Broker
As cloud computing evolves, the integration of cloud services
can be too complex for cloud consumers to manage. A cloud
consumer may request cloud services from a cloud broker,
instead of contacting a cloud provider directly. A cloud broker
is an entity that manages the use, performance, and delivery of
cloud services and negotiates relationships between cloud
providers and cloud consumers.
In general, a cloud broker can provide services in three
categories:
Service Intermediation: A cloud broker enhances a given
service by improving some specific capability and providing
value-added services to cloud consumers. The improvement can
be managing access to cloud services, identity management,
performance reporting, enhanced security, etc.
Service Aggregation: A cloud broker combines and
integrates multiple services into one or more new services. The
broker provides data integration and ensures the secure data
movement between the cloud consumer and multiple cloud
providers.
Page 21

aggregation except that the services being aggregated are not
fixed. Service arbitrage means a broker has the flexibility to
choose services from multiple agencies. The cloud broker, for
example, can use a credit-scoring service to measure and select
an agency with the best score.
2.2.2.5 Cloud Carrier
A cloud carrier acts as an intermediary that provides
connectivity and transport of cloud services between cloud
consumers and cloud providers. Cloud carriers provide access to
consumers through network, telecommunication, and other
access devices. For example, cloud consumers can obtain cloud
services through network access devices, such as desktop
computers, laptops, mobile phones, and other mobile Internet
devices (MIDs). The distribution of cloud services is normally
provided by network and telecommunication carriers or a
transport agent, where a transport agent refers to a business
organization that provides physical transport of storage media,
such as high-capacity hard drives.
2.2.2.6 Scope of Control between Provider and Consumer
The cloud provider and cloud consumer share the control of
resources in a cloud system. As illustrated in Figure 3, different
service models affect an organization’s control over the

computational resources and thus what can be done in a cloud
system. Figure 3 shows these differences using a classic
software stack notation comprised of the application,
middleware, and OS layers. This analysis of delineation of
controls over the application stack increases understanding of
the responsibilities of parties involved in managing the cloud
application.
Figure 3: Scope of Controls between Provider and Consumer
The application layer includes software applications
targeted at end users or programs. The applications are used by
SaaS consumers, or installed/managed/maintained by PaaS
consumers, IaaS consumers, and SaaS providers.
The middleware layer provides software building blocks
(e.g., libraries, database, and Java virtual machine) for
developing application software in the cloud. The middleware is
used by PaaS consumers, installed/managed/maintained by IaaS
consumers or PaaS providers, and hidden from SaaS consumers.
Page 22
operating system and drivers, and is
hidden from SaaS and PaaS consumers. An IaaS cloud allows
one or multiple guest OSs to run virtualized on a single physical
host. Generally, consumers have broad freedom to choose which
OS is to be hosted among all the OSs that could be supported by

the cloud provider. The IaaS consumers should assume full
responsibility for the guest OS(s), while the IaaS provider
controls the host OS.
2.2.3 Architecture Components
This section describes the architectural elements with which
cloud actors interact, including an abstraction of the system
components that orchestrate together to deliver the service
capabilities, the different deployment models of these
infrastructure components, and the management activities cloud
providers engage in with cloud consumers.
2.2.3.1 Service Orchestration
Service Orchestration refers to the composition of system
components to support the cloud provider activities in
arrangement, coordination, and management of computing
resources in order to provide cloud services to cloud consumers.
Figure 4 shows a generic stack diagram of this composition that
underlies the provisioning of cloud services.
Figure 4: Cloud Provider - Service Orchestration
A three-layered model is used in this representation to depict
the grouping of the three types of system components that cloud
providers need to compose to deliver their services.
In the model shown in Figure 4, the top is the service layer,
where cloud providers define interfaces for cloud consumers to
access the computing services. Access interfaces of each of the
three service models are provided in this layer. It is possible,

though not necessary, that SaaS applications can be built on top
of PaaS components, and PaaS components can be built on top
of IaaS components. The optional dependency relationships
among SaaS, PaaS, and IaaS components are represented
graphically as components stacking on each other; while the
angling of the components represents that each of the service
component can stand by itself. For example, a SaaS application
can be implemented and hosted on
Page 23
virtual machines from an IaaS cloud, or it can be implemented
directly on top of cloud resources without using IaaS virtual
machines.
The middle layer in the model is the resource abstraction and
control layer. This layer contains the system components that
cloud providers use to provide and manage access to the
physical computing resources through software abstraction.
Examples of resource abstraction components include software
elements such as hypervisors, virtual machines, virtual data
storage, and other computing resource abstractions. The
resource abstraction needs to ensure efficient, secure, and
reliable usage of the underlying physical resources. While
virtual machine technology is commonly used at this layer,
other means of providing the necessary software abstractions

are also possible. The control aspect of this layer refers to the
software components that are responsible for resource
allocation, access control, and usage monitoring. This is the
software framework that ties together the numerous underlying
physical resources and their software abstractions to enable
resource pooling, dynamic allocation, and measured service.
Various open source and proprietary cloud software are
examples of this type of middleware.
The lowest layer in the stack is the physical resource layer,
which includes all the physical computing resources. This layer
includes hardware resources, such as computers (CPU and
memory), networks (routers, firewalls, switches, network links,
and interfaces), storage components (hard disks), and other
physical computing infrastructure elements. It also includes
facility resources, such as heating, ventilation and air
conditioning (HVAC), power, communications, and other
aspects of the physical plant.
Following system architecture conventions, the horizontal
positioning, i.e., the layering, in a model represents dependency
relationships – the upper layer components are dependent on
adjacent lower layer to function. The resource abstraction and
control layer exposes virtual cloud resources on top of the
physical resource layer and supports the service layer where
cloud services interfaces are exposed to cloud consumers. Cloud
consumers do not have direct access to the physical resources.

2.2.3.2 Cloud Service Management
Cloud Service Management includes all of the service-related
functions that are necessary for the management and operation
of those services required by or proposed to cloud consumers.
Cloud service management can be described from the
perspective of business support, provisioning and configuration,
and from the perspective of portability and interoperability
requirements.
2.3 NIST Cloud Computing Taxonomy
The NIST Cloud Computing taxonomy was developed in
conjunction with the reference architecture and describes key
cloud computing concepts, the relationships between these
concepts, and their given context. The taxonomy organizes the
key concepts into four levels:
Level 1: Role, which indicates a set of obligations and
behaviors as conceptualized by the associated actors in the
context of cloud computing;
Level 2: Activity, which entails the general behaviors or
tasks associated to a specific role;
Level 3: Component, which refers to the specific processes,
actions, or tasks that must be performed
to meet the objective of a specific activity; and
Level 4: Sub-component, which presents a modular part of a
component.
The taxonomy can be used as a source for developing a

controlled vocabulary of cloud computing terms that will
provide an increased clarification and standardization of the
cloud computing terminology. Details about this taxonomy and
the related vocabulary can be found on the NIST cloud
computing
Page 24
reference architecture and taxonomy collaboration site:
http://collaborate.nist.gov/twiki-cloud-
computing/bin/view/CloudComputing/ReferenceArchitectureTax
onomy.
Page 25
3 Cloud Computing Use Cases and Requirements
Although use cases have been traditionally employed as a
system analysis tool that links the actors to the system
functions, the same methodology has also been widely used
within business architectures for such purposes as describing
business processes of an enterprise, actors corresponding to
these processes, and organizational participants. Using well-
defined elements such as actors, conditions, and activity flows,
a use case can systematically reveal the requirements and
constraints which can subsequently direct system architecture

and design.
The NIST projects and working groups apply use case
methodology to define business and technical operational
scenarios and requirements.
Business use cases document scenarios at the functional
mission level. The use case describes the
business goal with no assumptions as to how cloud computing
technology (deployment model constraints) will be deployed to
achieve that goal. These business use cases can then be explored
by walking through the considerations of planning and
deploying candidate cloud computing service and deployment
model options, issues, and constraints. While this process has
documented business use cases that are in pilot or operational
deployment stage, the objective of the Target focuses on those
business use cases that agencies have identified as an
opportunity, but consider to be difficult to implement, or have a
perceived impediment to implementation.
The second case where use case methodology is applied is
definition of technical use cases in the
Standards Acceleration to Jumpstart the Adoption of Cloud
Computing (SAJACC) effort. These use cases are designed to
facilitate the qualitative testing of standards through the use of
third-party APIs implemented in adherence to candidate

specifications and emerging standards. Of necessity, each
SAJACC use case represents a single activity, such as the
deletion of data, and the actions needed to successfully execute
that activity (receive the request, respond to the request,
execute the request, etc.).
A business use case is decomposed into a list of high-level
requirements, then into successively more detailed
requirements, until it can ultimately be mapped to technical
requirements that are required to identify and execute the
appropriate SAJACC use cases.
3.1 Target Business Use Case and High-Level Requirements
The main objective of the NIST Cloud Computing Target
Business Use Case (TBUC) Project is to work with federal CIOs
to identify and document application and service use cases for
potential migration to a cloud environment. As described in the
Federal Cloud Computing Strategy, NIST is working with
agencies to define target business use cases that are complex, or
have technical hurdles or standards gaps that need to be
overcome. The high-level requirements that are extracted from
the target business use cases are the primary deliverables for
that project area.
Page 26
At the time of this writing, the business use cases from agencies

and departments summarized here have perceived impediments
or obstacles that prevent their immediate implementation or
require workarounds. These business use cases focus attention
on the areas where technical and procedural gaps are assessed
and prioritized to propose recommendations for mitigation.
After target business use cases are developed,
they are analyzed to determine which business requirements are
pertinent to the cloud. These business requirements are
examined to determine their relevance to security, portability,
and interoperability needs, and whether they are mission-
specific requirements or cross-cutting requirements. The final
step is to determine the relationship of the business
requirements to the SAJACC technical use cases.
A template to capture target business use cases was created and
is described in the next section. An initial portfolio of target
business use cases using this template was developed using two
methods. The most common approach is documentation via
interviews with agency and department CIOs identified through
the Federal CIO Council Cloud Computing Executive Steering
Committee and Cloud First Task Force. Information is gathered
about the business use case through information provided by
agencies, after which NIST-led interviews of key members of
the cloud effort are conducted to flesh out the business use case
and identify areas of concern. Alternatively, participants in the
NIST-chaired public Cloud Computing Business Use Case

Working Group (CCBUCWG) volunteer to document and obtain
agency sponsorship of business use cases that might be of
interest. Sponsoring federal agencies develop the business use
cases and submit them to the project team as contributions. As
business use cases are drafted, they are presented to the Cloud
Computing Business Use Case Working Group for review and
comment.
As requirements are identified and areas of research are
prioritized, NIST works with federal agencies, industry, SDOs,
and academia to identify options for addressing challenges,
using the vendor-neutral reference architecture and taxonomy as
a frame of reference. This research results in the definition of
new or augmented standards, guidance, and technology
requirements where appropriate. The portfolio of target business
use cases can also be used by Federal CIOs to aid them in
considering their projects. As federal CIOs identify new
business use cases, it is helpful to the broader community to add
them to this portfolio. As the portfolio of business use cases is
expanded, trends and commonalities become more apparent,
permitting prioritization of research areas.
Highlights: Target business use cases of federal agencies were
captured to understand security, interoperability, and portability
requirements. These business use cases and the cross-cutting
requirements extracted were developed as part of the iterative
and complementary process used to identify the strategic

requirements in Volume I of the Technical Roadmap.
Specifically, this section summarizes the use cases which were
used as the basis for defining the following high-priority
requirements listed in the NIST USG Cloud Computing
Technology Roadmap Volume I high- priority requirements:
“

Special Publication 500-293 (Draft) US Government Cloud Computin.docx

More Related Content

Similar to Special Publication 500-293 (Draft) US Government Cloud Computin.docx (20)

More from rafbolet0 (20)

Recently uploaded (20)

Special Publication 500-293 (Draft) US Government Cloud Computin.docx