Cloud Essentials+ cheat sheet

Apply the NIST cloud model rather than a marketing label alone.

Self-service, broad access, pooling, elasticity and measurement describe different capabilities.

Pooling and tenant isolation require evidence at the relevant layer.

Elasticity adapts capacity to demand; released compute does not remove every other charge.

Cloud economics depend on utilization, contracts, migration and ongoing costs.

NIST SP 500-292 defines five roles: consumer, provider, auditor, broker, carrier.

The service model determines where the management boundary sits, not the technology used.

In SaaS the consumer still owns identities, access rights, configuration and data.

TCO must include migration, integration, egress, training and dual-running costs.

Choose migration approaches per workload after checking dependencies, support, operating burden and business value.

An SLA defines measurable levels and remedies such as service credits, not a guarantee.

Exit strategy and data portability should be agreed before, not after, signing.

Provider selection weighs certification, data location, roadmap and support alongside price.

Security of the cloud belongs to the provider; security in the cloud belongs to the consumer.

The responsibility boundary shifts with IaaS, PaaS and SaaS.

ISO/IEC 27017 covers cloud-specific controls; ISO/IEC 27018 covers PII in public clouds.

Verify actual legal roles, data locations, contractual duties and the scope of assurance evidence.

A provider's certification does not make the consumer's configuration compliant.

RTO is the maximum acceptable outage; RPO is the maximum acceptable data loss in time.

RPO drives backup and replication frequency; RTO drives standby and failover design.

Showback reports consumption to teams; chargeback actually bills it to them.

Incident management restores service; problem management removes the root cause.

Monitor end-to-end service levels and spend, not only infrastructure health.