Cloud deployment models: public, private, hybrid, community and multi-cloud
In short: A deployment model describes where cloud resources run and who shares them. Public, private, hybrid, community and multi-cloud each balance cost, control and compliance differently, and most organisations end up mixing more than one.
What a deployment model describes
When people say "the cloud" they usually mean a big provider such as AWS, Microsoft Azure or Google Cloud. But cloud is really a way of delivering computing: on-demand self-service, broad network access, pooled resources, rapid elasticity and measured usage. Those five characteristics come from NIST SP 800-145, which also defines the classic deployment models. A deployment model answers two questions: who owns the infrastructure, and who else shares it?
The five models
| Model | Who uses it | Typical example |
|---|---|---|
| Public | Any customer, on shared provider hardware | A start-up hosting its web app on a hyperscaler |
| Private | One organisation, on-premises or hosted | A bank running OpenStack or VMware in its own data centre |
| Hybrid | One organisation, linking private and public | Customer records on-premises, web front end in the public cloud |
| Community | Several organisations with shared needs | A government cloud shared by public-sector bodies |
| Multi-cloud | One organisation using several public providers | Email on one provider, analytics on another |
Hybrid and multi-cloud are often confused. Hybrid means private and public working together, usually with network links between them. Multi-cloud means more than one public provider. A company can be both at once.
Trade-offs to understand
- Cost model: public cloud is operating expenditure (OpEx), billed per second or per gigabyte. Private cloud is mostly capital expenditure (CapEx) on servers you must buy before you need them.
- Control: private cloud lets you choose hardware, hypervisor and physical security. In public cloud you rely on the provider's audits, such as ISO/IEC 27001 and SOC 2 reports.
- Compliance: data protection laws may require data to stay in a country. Public providers offer regions for this, but some sectors still choose private or community clouds.
- Skills: every extra model adds tooling, training and monitoring work. Complexity is a security risk in itself.
Whatever the model, the shared responsibility model still applies: the provider secures what it runs, and you secure what you put on it.
Choosing a model
- Classify the data: is it public, internal, confidential or regulated?
- Check legal and contractual rules on where data may live.
- Look at demand: spiky or seasonal workloads suit public cloud elasticity.
- Check dependencies: legacy systems tied to old hardware may need to stay private for now.
- Estimate total cost over three to five years, including staff and licences.
- Choose the simplest model that meets the requirements, then document why.
Tip: in exams, link the model to a reason. "Hybrid, because patient records must stay on-premises while the booking site scales in public cloud" scores better than just naming the model.
Practice
A university uses Microsoft 365 for email and Google Cloud for research computing, with no on-premises servers. Which model is this?
Why might a hospital choose hybrid cloud?
Name one security downside of using many cloud models at once.
Key takeaways
- A deployment model says who owns the infrastructure and who shares it.
- Public, private, hybrid, community and multi-cloud are the main models.
- Hybrid means private plus public; multi-cloud means several public providers.
- Choose from data classification, law, demand pattern and total cost.
- Shared responsibility applies in every model.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.