The framework suggested is not a panacea, as variations
occur in each of the different service models (SaaS, PaaS or
IaaS) and deployment models (public, community, private,
or hybrid). Variations also occur depending on whether the
private/community clouds are onsite, outsourced or virtual
(virtual private clouds). A cloud-consuming business needs to
be aware of risk variations within each cloud model and remain
accountable for risk and security regardless of the cloud model
or the contractual obligations of the cloud service provider.