• Inquire about exception monitoring systems.
• Be vigilant around updates and making sure that your staff don't suddenly gain access privileges they're not supposed to.
• Ask where the data is kept and inquire as to the details of data protection laws in the relevant jurisdictions.
• Seek an "independent security audit" of the host
• Find out which third parties the company deals with and whether they are able to access your data
• Be careful to develop good "policies around passwords"; how they are created, protected and changed.
• Look into availability guarantees and penalties.
• Find out whether the cloud provider will accommodate your own "security policies"

Salford Software offer free workshops around Identity Management and Enterprise Single Sign on  - we also offer Independant review services with full documentation,
call me on 0161 906 2233 for more details.