The framework's implementation will be impacted by any legal, contractual, regulatory, or other information security requirements specific to the cloud regarding the choice of appropriate information security controls.