Among the control challenges are insufficient security audit possibilities, and the fact that certification schemes and security metrics aren't adopted to cloud computing.