Organizations still unclear on cloud security responsibility