Assessing legal risks in the move to cloud