A cloud service could usually be filed under IT or OT anyway. Why is cloud named as a category of its own?
Because of its sheer spread in recent years and the extra complexity it adds to the security picture — it is called out explicitly so that it does not get quietly absorbed into "IT" and then forgotten.
Taxonomically the objection is correct: a cloud-hosted ERP is IT, a cloud-connected plant telemetry service is OT. Cloud is a delivery model, and the other three are purpose categories, so the four do not form a clean partition.
It is listed separately for a practical reason: cloud changed the security problem rather than just relocating it.
- The system boundary moves out of your hands. With on-premises IT you can point at the cable and the rack. With a cloud service the boundary runs through a contract and a provider's configuration screen.
- Shared responsibility. Some controls are the provider's, some are yours, and incidents cluster exactly where each side assumed the other had it.
- Perimeter thinking stops working. A public service is reachable from the internet by design — it is not "inside" anything you own.
- It arrives without asking. A department can buy SaaS on a credit card, so the estate grows in places the architecture never planned.
Tip: the honest reading of the four-way split is "IT, OT, IoT — plus a delivery model that breaks the assumptions of all three, so we name it".
Go deeper:
NIST SP 800-145 — The NIST Definition of Cloud Computing — the five characteristics and three service models that make cloud a delivery model rather than a place.- AWS — Shared Responsibility Model — the split that decides which half of cloud security is yours; incidents cluster on the seam.