Date Published: August 21, 2026
Comments Due:
Email Comments to:
Author(s)
Michaela Iorga (NIST), Nedim Goren (NIST)
Announcement
NIST Internal Report (IR) 8613 ipd (initial public draft), Multi-Cloud Architecture Challenges, identifies, categorizes, and analyzes the security and compliance challenges that are unique to or significantly amplified by multi-cloud architectures. This analysis by the NIST Multi-Cloud Security Public Working Group (MCSPWG) addresses security and Authorization to Operate (ATO) challenges and highlights areas where additional community research could meaningfully reduce risk.
The MCSPWG identified 23 consolidated challenge areas that represent novel friction points and architectural misalignments that emerge when orchestrating control across autonomous cloud silos. The most significant structural challenge areas are:
- Security-significant differences in cloud-native services across providers
- Organizational logistics and staffing complexity across heterogeneous environments
- Difficulty in implementing centralized security capabilities across provider boundaries
These structural gaps are most acute in five areas: (1) identity and access management, (2) telemetry and logging, (3) configuration and change management, (4) data protection, and (5) compliance and authorization.
Submit Your Comments:
NIST invites input from federal agencies, industry partners, researchers, and the broader cybersecurity community. The public comment period is open through October 5, 2026.
How to Participate:
Email your completed template to [email protected] with the subject line "NIST.IR.8613 Comments."
Working group participants submitted challenges, which were aggregated and reviewed. The challenges were first categorized as either security- or authorization-related, and then as functional or technical. Multi-cloud environments present unique security challenges arising from using multiple CSPs and/or CSOs, each with their own security models, tools, configurations, and shared responsibility frameworks. Authorization in a multi-cloud environment introduced challenges that differed from those in a single-system ATO process. Authorizations depend on clearly defined system boundaries, comprehensive security documentation, and the consistent enforcement of controls. In a multi-cloud environment with multiple Cloud Service Providers (CPSs) providing services to the Cloud Service Consumer (CSP), it may be difficult to identify system boundaries, network architecture, and security processes due to differing systems or proprietary information.
Working group participants submitted challenges, which were aggregated and reviewed. The challenges were first categorized as either security- or authorization-related, and then as functional or technical. Multi-cloud environments present unique security challenges arising from using multiple CSPs...
See full abstract
Working group participants submitted challenges, which were aggregated and reviewed. The challenges were first categorized as either security- or authorization-related, and then as functional or technical. Multi-cloud environments present unique security challenges arising from using multiple CSPs and/or CSOs, each with their own security models, tools, configurations, and shared responsibility frameworks. Authorization in a multi-cloud environment introduced challenges that differed from those in a single-system ATO process. Authorizations depend on clearly defined system boundaries, comprehensive security documentation, and the consistent enforcement of controls. In a multi-cloud environment with multiple Cloud Service Providers (CPSs) providing services to the Cloud Service Consumer (CSP), it may be difficult to identify system boundaries, network architecture, and security processes due to differing systems or proprietary information.
Hide full abstract
Keywords
Analysis; authorization; authorization challenges; Authorization to Operate (ATO); cloud service customer (CSC); cloud service provider (CSP); multi-cloud; multi-cloud architecture; security challenges; system security plan
Control Families
None selected
