As with most technological advances, regulators are typically in a “catchup” mode to identify policy, governance, and law . Cloud computing presents an extension of problems heretofore experienced with the Internet. As mentioned, legal decisions will ultimately determine who “owns” the responsibility for securing information shared within clouds . To ensure that such decisions are informed and appropriate for the cloud computing environment,the industry itself should establish coherent and effective policy and governance to identify and implement proper security methods. To facilitate such policy and governance’s emergence, the US National Institute of Standards and Technology (NIST), an agency of the Commerce Department’s Technology Administration, has created a cloud computing security group. This group envisions its role as promoting “the effective and secure use of the technology within government and industry by providing technical guidance and promoting standards” (see http://csrc.nist.gov/groups/SNS/cloud-computing/index.html). NIST has recently released its draft “Guideto Adopting and Using the Security Content Automation Protocol”