What is the cloud?
Cloud computing is a model in which you obtain computing power, storage, networks and applications on demand over a network from a provider’s shared pool, scaling them up or down quickly and paying for what you use. Instead of buying and managing your own servers (On-Premise), you rent capacity and services from a cloud provider such as Microsoft Azure, Amazon Web Services (AWS), Google Cloud or European providers like OVHcloud and STACKIT. In industrial environments, the cloud is mainly used for data storage, analytics and remote management, while process control itself stays local.
🧠 What are the characteristics of cloud computing?
The most widely used definition comes from NIST SP 800-145 (2011). It lists five essential characteristics:
| Characteristic | Meaning | What it means for you |
|---|---|---|
| On-demand self-service | You provision capacity yourself, without the provider’s involvement | A server or database is ready within minutes |
| Broad network access | Services are reachable over standard network protocols | Access from any location, including over private connections |
| Resource pooling | Hardware is shared by multiple customers (multi-tenant) | Lower costs, but you share infrastructure with others |
| Rapid elasticity | Capacity grows and shrinks automatically with demand | Good scalability during peaks |
| Measured service | Usage is metered and billed | Pay-as-you-go rather than a large upfront investment |
A network connection is therefore always required, but it does not have to be the public internet. Many companies connect their sites to the cloud over a private link such as Azure ExpressRoute or AWS Direct Connect.
☁️ What are the service models: IaaS, PaaS and SaaS?
NIST distinguishes three service models. The higher up the stack, the more the provider handles for you. This also determines who owns which security task, known as the shared responsibility model:
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Data centre, hardware, hypervisor | Provider | Provider | Provider |
| Operating system and patches | Customer | Provider | Provider |
| Middleware and runtime | Customer | Provider | Provider |
| Application | Customer | Customer (own code) | Provider |
| Data, users and access rights | Customer | Customer | Customer |
| Example | Virtual machines, storage, networks | Databases, IoT hubs, container platforms | Microsoft 365, cloud ERP, cloud MES |
The bottom row always applies: which data you store, who may access it and how you handle authentication remain your responsibility. With IaaS, updates are therefore not automatic; you patch the operating system yourself.
🧱 Which deployment models exist?
NIST names four deployment models: public, private, hybrid and community cloud. Multicloud is a later practitioner term for combining several providers.
- Public cloud - a provider’s shared infrastructure, available to anyone. Largest scale and lowest entry costs.
- Private cloud - cloud technology (virtualisation, self-service, automation) for a single organisation, in its own data centre or at a hosting provider.
- Hybrid cloud - a combination of on-premise or private cloud with public cloud. The most common form in industry: control and the historian stay local, analytics and reporting run in the cloud.
- Community cloud - shared by a group of organisations with similar requirements, such as government bodies or healthcare institutions.
- Multicloud - services from several providers at once, often to limit dependence on a single vendor.
🔄 What is the difference between cloud and on-premise?
| Aspect | Cloud | On-Premise |
|---|---|---|
| Hosting location | Provider’s data centre | Own site or own data centre |
| Cost model | Subscription or usage (opex) | One-off investment plus maintenance (capex) |
| Management | Shared, depending on IaaS, PaaS or SaaS | Fully in-house |
| Scalability | Flexible, within minutes | Limited to your own hardware |
| Network required? | Yes, internet or private link | No, also works in isolation |
| Updates | By the provider for SaaS/PaaS, by you for IaaS | By your own team, at your own pace |
| Availability | SLAs of typically 99.9–99.99% per service | Depends on your own redundancy |
| Suitable for OT control? | No, but suitable for supervision and analytics | Yes |
For comparison: 99.9% availability allows up to roughly 8.7 hours of downtime per year, 99.99% about 53 minutes. That is acceptable for an office application, but not for a control loop that must respond every 10 milliseconds.
🏭 What does industry use the cloud for?
- Data storage and analytics - storing and comparing production, energy and maintenance data from multiple plants centrally
- Predictive Maintenance and condition monitoring - training AI and ML models on large volumes of historical sensor data; see also Industrial AI
- Industrial Internet of Things platforms - centralised monitoring of dispersed assets such as pumping stations, wind turbines or charging points
- Digital twins - compute-intensive simulation and optimisation, fed with current process data
- Cloud-hosted SCADA and MES - mainly for geographically dispersed installations, usually as a hybrid solution with local control
- Backup and Disaster Recovery - keeping copies of configurations, PLC programs and historian data off site
- Remote maintenance - vendors and in-house engineers supporting installations without being on site
🔧 How do you connect OT to the cloud securely?
A direct connection between the cloud and the control network is the biggest risk. In practice there are four common patterns:
| Pattern | How it works | Suitable for |
|---|---|---|
| Edge gateway, outbound only | An edge device reads data locally via OPC UA or Modbus and publishes it encrypted to the cloud, for example via MQTT over TLS (port 8883) or HTTPS (443). No inbound ports are open. | Most IIoT and analytics applications |
| Via the IDMZ | Data flows from the OT network to a replica historian or broker in the IDMZ and only from there to the cloud. There is no direct route from cloud to OT. | Existing plants following the Purdue Model |
| Data diode | Hardware that physically lets traffic pass in one direction only, from OT outwards. Writing back is impossible. | Critical infrastructure and high security levels |
| Cloud-hosted SCADA | SCADA server in the cloud; controllers and local HMI stay on site and keep running independently if the connection is lost. | Dispersed assets with slow processes, such as water and energy |
Every pattern needs store-and-forward: the edge buffers data locally when the connection drops and sends it on later. Edge runtimes such as AWS IoT Greengrass and Azure IoT Edge provide this out of the box. A Unified Namespace at the edge makes the same data available to local and cloud applications at the same time. See also Edge Computing.
🔐 Who is responsible for security in the cloud?
The provider secures the cloud itself; you are responsible for the security of what you put in it. The main risks for IT/OT organisations are:
- Misconfiguration - publicly reachable storage or overly broad permissions are a common cause of data breaches
- Stolen accounts - administrator accounts belong behind multi-factor authentication; many organisations synchronise their on-premise Active Directory with Entra ID (called Azure Active Directory until July 2023)
- New attack paths into OT - every cloud connection is a conduit in the sense of IEC 62443 and belongs in the risk assessment
- Dependence and outages - provider incidents or a lost connection must not stop the process
- Services that disappear - Google shut down Cloud IoT Core on 16 August 2023, forcing users to migrate within a year
Baseline measures are encryption of data at rest and in transit, Zero Trust access instead of a permanent VPN, a firewall that allows only the required outbound connections, and logging into your own monitoring. For compliance, ask the provider for certifications against recognised security standards such as ISO 27001, ISO/IEC 27017 (cloud security) and ISO/IEC 27018 (personal data in the public cloud). You apply IEC 62443 to your own OT environment and to its connection with the cloud.
🧭 Which European rules apply to cloud use?
| Regulation | What it means for cloud | Since |
|---|---|---|
| Data Act | Right to switch to another provider: maximum 2 months’ notice and a 30-day transition period. Switching charges may only cover actual costs and disappear entirely from 12 January 2027. | 12 September 2025 |
| NIS2 | Medium-sized and large cloud providers fall under digital infrastructure. Implementing Regulation (EU) 2024/2690 sets out their technical measures. As a customer, you must manage the security of your suppliers. | 17 October 2024 (transposition deadline) |
| Dutch Cybersecurity Act | Dutch implementation of NIS2 (Cyberbeveiligingswet, not to be confused with the EU Cybersecurity Act), including a duty of care for supply chain security | 15 August 2026 |
| GDPR | Personal data leaving the EU requires a valid transfer mechanism | 25 May 2018 |
Digital sovereignty also plays a role. The US CLOUD Act (2018) gives US authorities, under certain conditions, access to data held by US providers, even when it is stored in Europe. Providers are responding with European variants: Microsoft completed its EU Data Boundary in February 2025, and AWS opened the AWS European Sovereign Cloud in Brandenburg in early 2026. ENISA’s European certification scheme EUCS, in development since 2020, has still not been adopted. Factor sovereignty and supplier security into your choice yourself; see also Supply Chain Risk.
🎯 When must control stay local?
Control loops, interlocks and safety functions always belong on site. A PLC works with cycle times of a few to tens of milliseconds and real-time behaviour, whereas latency to a cloud region easily amounts to a few to tens of milliseconds, with unpredictable variation (jitter) and the risk of losing the connection altogether. The UK NCSC published guidance on cloud-hosted SCADA on 18 March 2024, asking organisations to assess three things: the business drivers, their own organisational readiness and the suitability of the technology. A practical approach:
- Define the purpose - analytics, reporting or remote management? Read only, or also write?
- Classify the data - which process data is sensitive, and does it contain personal data?
- Choose the connection pattern - outbound via edge or IDMZ, or a data diode for high requirements. Write from the cloud to OT only with separate approval.
- Design for connection loss - local control, local HMI and store-and-forward must keep working without the cloud.
- Agree responsibilities - who manages what in IaaS, PaaS or SaaS, and which SLA and exit strategy apply?
- Check regulation - NIS2, the Dutch Cybersecurity Act, GDPR and the switching rights under the Data Act.
❓ Frequently asked questions
What is the difference between IaaS, PaaS and SaaS?
With IaaS you rent virtual servers, storage and networks and manage the operating system and applications yourself. With PaaS the provider also supplies the platform, such as a database or IoT hub, and you only write the application. With SaaS you use ready-made software and only manage users and data.
Can a PLC or DCS run in the cloud?
A PLC or DCS does not belong in the public cloud, because control loops and safety functions must work deterministically and without depending on a network. The latency and possible outages of a cloud connection do not fit those requirements. Supervision, history and analytics can run in the cloud, with control staying local.
Is the cloud more secure than on-premise?
The cloud is not automatically more or less secure than on-premise. Large providers often secure their data centres and platforms better than an individual company can, but configuration, access rights and data remain the customer’s responsibility. Many cloud incidents are caused by misconfiguration or stolen accounts.
How do I connect a plant to the cloud securely?
The safest way to connect a plant to the cloud is with outbound-only, encrypted connections from an edge gateway or from the IDMZ, with no inbound ports into the OT network. For high security requirements, use a data diode that physically lets traffic pass in one direction only. Local control must keep working if the cloud connection is lost.
What does the Data Act mean for cloud users?
Since 12 September 2025, the Data Act has given cloud users the right to switch to another provider, with a maximum of two months’ notice and a thirty-day transition period. Until 12 January 2027 switching charges may only cover actual costs, after which they are abolished entirely. This reduces dependence on a single cloud provider.
Do cloud providers fall under NIS2?
Medium-sized and large cloud providers fall under NIS2 as providers of digital infrastructure and must meet the technical requirements of Implementing Regulation (EU) 2024/2690. As a customer, you remain responsible under NIS2 and the Dutch Cybersecurity Act for the security of your own supply chain. Selecting and managing a cloud provider therefore belongs in your own risk management.
📌 In summary
The cloud delivers scalable IT capacity as a service; in industry it excels at storage, analytics and remote management, but process control stays local. Choose deliberately between IaaS, PaaS and SaaS, know your part of the shared responsibility, connect OT only through outbound connections, an IDMZ or a data diode, and factor the Data Act, NIS2 and digital sovereignty into your decision.