Risk assessment as well as cost-benefit
If you have a risk assessment framework then when faced with cloud as one of your options, simply feed into your framework the different risks that come with a cloud-based service. Look at the resulting risk level as well as the costs of the service. If you're happy with the risk, or you can mitigate it, then cloud may win.
The only "production" cloud service we have is web-based email filtering. We've had it for a number of years and in the old days it may have been called SaaS or even just outsourced. But some of our corporate data spends its time on other people's servers and we judge that the risks are acceptable and the benefits worth paying for. When it comes to the likes of Office365, for example, that's a whole different ball game.
Having said that, while we haven't moved any of our other IT services into the cloud we ourselves are developing a cloud-based service for our customers. We chose one of the big players and have assessed the risks to us and to our customers. We're happy with the measures in place and will keep them under review.
Contributr 
