The National Institute of Standards and Technology (NIST) has issued a warning to organizations regarding the unique cybersecurity and compliance challenges inherent in multi-cloud environments. NIST's new report, published on August 21, highlights that utilizing two or more cloud service providers (CSPs) introduces complexities that make it difficult to maintain consistent security policies, apply uniform controls, and enforce robust authentication protocols compared to single-cloud or on-premises architectures.
A primary reason for these difficulties is that different CSPs operate with distinct security models, tools, configurations, and shared responsibility frameworks. While multi-cloud adoption is increasing, partly due to its benefit of reducing reliance on a single provider—thereby allowing operations to continue during an outage or cyberattack affecting one CSP—NIST emphasizes the significant security challenges it simultaneously introduces.
The report identifies 23 novel challenges across several critical areas. In identity and access management, security teams struggle to ensure consistent implementation of access control policies and authorization measures across diverse CSP systems, each with unique native architectures. This includes verifying the deployment of multi-factor authentication (MFA) or biometric verification across all CSPs for specific information systems supporting cloud services. These challenges are further complicated by the need to verify the access control policies of third-party vendors used by CSPs.
Vulnerability management also becomes more intricate in multi-cloud settings. CSPs often provide vulnerability reports in varying timeframes and formats, hindering a unified approach to patch management across an enterprise. Additionally, customers may lack direct access to CSPs' information systems, preventing them from conducting independent vulnerability scans.
For incident response and disaster recovery, organizations face hurdles due to CSPs potentially not providing timely or comprehensive incident data, or delivering it in non-standardized formats. Administrative access privileges necessary for independent monitoring of cloud services across different providers may also be withheld. Planning for disaster recovery is further complicated by CSPs frequently withholding contingency planning policies and test results, citing concerns over privileged backend information and overall system security.
Data protection is another area of concern. Organizations depend on CSPs to ensure security, encryption, and regulatory standards are met. However, inconsistent implementations of data security measures, such as encryption, among different CSPs in a multi-cloud environment can lead to non-compliance with data protection regulations across various jurisdictions, including laws like the EU’s General Data Protection Regulation (GDPR). Obtaining comprehensive information system security documentation from all providers involved in data protection also presents difficulties in demonstrating compliance.
NIST advocates for robust governance frameworks, centralized visibility, consistent policy enforcement, and a strong emphasis on automation and standardization to tackle these multi-cloud challenges. The institute stresses that addressing these issues will require a collaborative effort from the broader cybersecurity community.
The report aims to establish a structured problem statement and a shared vocabulary to inform future research, procurement strategies, standards development, and solution design across government, industry, and academia. NIST is actively seeking input from federal agencies, industry partners, researchers, and the cybersecurity community, with a public comment period open until October 5, 2026.
