We always hear people telling everything is now in the Cloud. Precisely, this is somehow incorrect. Even though there are IaaS, PaaS, SaaS etc., there are physical equipment on SOMEBODY’s premise to serve the client.
It is just the client has only a very slim footprint – likely a physical device with web browser connecting to the Internet for all the services (infrastructure, platform, software) required in the Cloud.
When we develop written directives, don’t be influenced by jargons. We need to have a holistic view to stipulate precise generic while certain situation precise specific rather than putting a case-by-case assessment. This will end up no policy at all.