Tinkering with Cloud Security to Meet with Compliance Regulations

As more and more services are moving to the cloud, especially with players like Microsoft (see Microsoft Azure) and Google (see Google Health) making their Goliathic rise to the cumulus space, the dark overcast of government regulations is also beginning to hover like the summer fog over the Sunset district of San Francisco.
(Side note: the unfortunate side effect of blogs is that it provides a liberal forum for writing hacks like me; sorry for the 2nd grade poetry; and now I need to apologize to 2nd graders)
Cloud services providers have three choices:
1 - Create a specialized "cloud within a cloud" to address specific regulations. Imagine a "HIPAA" or "SOX" cloud.
2 - Create a cloud architecture that meets the toughest standards possible so that all users can "benefit" from the heightened data privacy measures.
3 - Create a cloud architecture that is flexible and allows IT directors to choose the right tools to address specific security concerns and control their environment.
No. 1 seems cost prohibitive, without probable market scale that would justify it. No. 2 lacks the necessary agility to allow IT directors to adapt to a specific company's business processes.
I'm betting on the horse that takes lane no. 3.
Stay tuned...
