  The present paper shows a proposal of the characteristics Cloud Risk
Assessment Models should have and presents the review of the literature
considering those characteristics in order to identify current gaps. This work
shows a ranking of Cloud RA models and their degree of compliance with the
theoretical reference Cloud Risk Assessment model. The review of literature
shows that RA approaches leveraging CSA (Cloud Security Alliance) STAR Registry
that have into account organizations security requirements present higher
degree of compliance, but they still lack risk economic quantification. The
myriad of conceptual models, methodologies and frameworks although based on
current NIST SP 800:30, ISO 27001, ISO 27005, ISO 30001, ENISA standards could
be enhanced by the use of techno-economic models like UTEM, created by the
author, in order to conceive more simplified models for effective Risk
Assessment and Mitigation closer to the theoretical reference model for Cloud
Risk Assessment, available for all cloud models (IaaS, PaaS, SaaS) and easy to
use for all stakeholders.
