But isn't that already being done everywhere?

"You would think so, but you'd be surprised how often it isn't done," he says.

If you are allowing employees to access any Web site from anywhere inside your firewall, that needs to be changed, according to Trembly. "That leaves you really wide open to malware and those kinds of risks."

"If security is the number one thing on your agenda, then the cloud is probably not a wise move, at least not yet," Trembly says. "That inherent risk is not something I advise clients to take if they are in a business that is data dependent. Generally, what I'm hearing at conferences and from clients is [proceed with] great caution."

covers Enterprise Applications, SaaS, CRM, and Cloud Computing for CIO.com. Follow Todd on Twitter . Follow everything from CIO.com on Twitter and on . Email Todd at You can also join Todd in the "CIO Forum" group on to talk with CIOs and IT managers about the things that keep them up at night.