Cloud services are commonly offered as Platform-As-Service (PaS), Software-AsService (SaaS) and Infrastructure-As-Service (IaS). Devising an information security strategy for the cloud requires establishing clear boundaries of responsibilities related to information security and governance for each model.