1 NIST Special Publication 5 00-299 1 2 3 4 NIST Cloud Computing 5 Security Reference Architecture 6 7 8 9 10 11 NIST Cloud Computing Security Working Group 12 NIST Cloud Computing Program 13 Information Technology Laboratory 14 15 16 17 18 19 2 This page left intentionally blank 20 21 Page 3 Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost -effective security and privacy of sensitive unclassified information in Federal computer systems. This document reports on ITL’s research, guidance, and outreach efforts in Information Technology and its c ollaborative activities with industry, government, and academic organizations. DISCLAIMER This document has been prepared by the National Institute of Standards and Technology (NIST) and describes standards research in support of the NIST Cloud Computing Program. Certain commercial entities, equipment, or material may be identified in this document in order to describe a concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that these entities, materials, or equipment are necessarily the best available for the purpose. Page 4 Acknowledgements NIST gratefully acknowledges the broad contributions of the NIST Cloud Computing Security Working Group (NCC SWG) , chaired by Dr. Michaela Iorga. Dr. Iorga was principal editor for this document with assistance in editing and formatting from Hannah Wald , Technical Writer, Booz Allen Hamilton , Inc. The following list (in alphabetical order by last name) includes contributors1 and internal reviewers who previously agreed to be acknowledged in this document . The list will be updated when we receive more confirmations from our members . CONTRIBUTORS: Wayne W. Armour , Independent C onsultant Nadeem Bukhari , Kinamik Data Integrity William Butler, PhD., Capitol College – Graduate School of Information Assurance Alvaro A. Cardenas , Fujitsu Laboratories of America Pw Carey , Compliance Partners, LLC Kyle Coble , Department of Homeland Security Vince Grimaldi, Independent C onsultant Muhammad F. Islam , PhD ca ndidate, G eorge Washington U niv. & Booz Allen Hamilton, Inc . Jerry Kickenson , SWIFT Juanita Koilpillai, Electrosoft Services, Inc. Prabha K umar , PhD., D epartment of Defense – Chief Information Office Nancy M. Landreville , PhD., Eme Sec (under -contract Dep. of V eteran Affairs) & UMD Anne L. Lee, PhD., U.S. Air Fo rce - Space and Missile Syste ms Center Cheng- Yin Lee, Independent C onsultant Chan Lim , IBM Ketan Mehta , Booz Allen H amilton , Inc. Keyun Ruan , PhD., University College Dublin & EADS N.V., XENSIX Inc. Arnab Roy , Fujitsu Laboratories of America Michael A. Salim , American Data Technology, Inc. Ken E. Stavinoha, PhD., Cisco Systems INTERNAL REVIEWERS: Wayne W. Armour , Independent C onsultant Jerry Kickenson , SWIFT Juanita Koilpillai, Electrosoft Services, Inc. Michael A. Salim , American Data Technology, Inc. 1 “Contributors” are members of the NCC SWG who dedicated substantial time on a regular basis to resear