“…Despite ITIL providing these guidelines for the allocation of roles and responsibilities to IT controls, organisations find it difficult to implement the ITIL framework (Ying, Lijun, & Wei, 2009) because it is not organisation-specific (McNaughton, Ray, & Lewis, 2010;Shang & Lin, 2010) and it only provides guidelines, thereby leaving implementation issues to the practitioners themselves (Cox, 2013;Pereira & Silva, 2010;Ying et al, 2009). Provided criteria are very generic and not specific to a cloud environment.…”