While many organizations advertise that their cloud hosting environments are very secure and compliant with numerous data security regulations such as HIPAA/HITECH or PCI DSS, the devil is always in the details. Just because an organization moves their web services, applications and data to a cloud hosting provider that advertises much security, doesn’t mean that what has been moved is secure enough, and doesn’t mean that security is enabled appropriately by default within the cloud infrastructure commensurate with the application nuances and risk profiles of the underlying business applications and data. Careful considerations in securing all cloud hosted components must be taken. For example, just because an application and database is in a secure cloud, it doesn’t mean that the applications and databases don’t need to be monitored by a SIEM or an MSSP using best practice guidelines for security monitoring. Everything that has been learned over the years about how best to economically secure IT infrastructure and business applications, still applies in the cloud.