What considerations are necessary when implementing security controls in a cloud environment for Acra Lending?