Abstraction. often via virtualization. frees the resources from their physical constraints to enable pooling. Then a set of core connectivity and delivery tools(orchestration)ties these abstracted resources together. creates the pools. and provides the automation to deliver them to customers.
Ref: CSA Security Guidelines V4.0

Thats how Devops is referred

A Soc3 reports on the same information as a Soc2 report. The main difference between the two is that a Soc3 is intended fora general audience. These reports are shorter and do not include the same details as a Soc2 report, which is distributed to an informed audience of stakeholders. Due to their more general nature, Soc3 reports can be shared openly and posted on a company's website with a seal indicating their compliance

IS0/lEC17788 lists six key characteristics. the first five of which are identical to the NIST characteristics.
The only addition is multitenancy. which is distinct from resource pooling.
Ref: CSA Security Guidelines V4.0

This is a tricky question. It is true that health care facility need to comply with HIPAA but if the healthcare facility is processing credit cards, they will have to comply with PCI DSS as well