Several regional hospitals want to share cloud infrastructure that is provisioned for their exclusive use, because they all have the same regulatory and privacy requirements. One of the hospitals will operate it on behalf of the group. Which NIST SP 800-145 deployment model is this?

NIST SP 800-145 defines four deployment models. A community cloud is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns, such as mission, security requirements, policy and compliance considerations. It may be owned, managed and operated by one or more of the organizations in the community, a third party or some combination, and may exist on or off premises. Hospitals sharing infrastructure because of common regulatory requirements, with one of them operating it, fits that definition precisely. A public cloud is provisioned for open use by the general public, so it is not exclusive to the hospitals, even if a public provider offers compliance certifications. A hybrid cloud is a composition of two or more distinct infrastructures, such as private and public, bound together by technology that enables data and application portability; a single shared infrastructure for a group does not meet that definition. A private cloud is provisioned for exclusive use by a single organization, possibly with multiple business units, whereas this infrastructure serves several separate organizations. Exam caveat: who operates the infrastructure does not determine the model; exclusivity and the community of users do. Operational check: document membership, shared requirements, governance and responsibility allocation among the participating organizations, and confirm controls meet each member's regulatory obligations.