Inadequate contractual arrangements with a cloud service provider may result in a variety of security issues that can be severe. If areas of responsibility, tasks, performance parameters, or efforts are described insufficiently or ambiguously, it is possible that the cloud service provider will not implement security safeguards sufficiently (or at all) due to a lack of resources.

Situations that are not clearly regulated in contracts can also result in disadvantages for the client. For example, cloud service providers often use third-party services to provide their own services. If there are insufficient contractual agreements or if the dependencies between the service provider and third party have not been disclosed, this can also have a negative effect on information security and the service provided to the organisation.