Cloud services should be evaluated for their security controls and included in the data security policy. Considerations such as cloud provider selection, secure web gateways, and data encryption in the cloud should be addressed to ensure data protection.