While cloud applications are often a cost effective way to adopt solid, well run infrastructure and applications, you typically still need your own compliance program laying out your governance, systems usage and operating procedures.