Paper investigates various risk assessment models applicable to cloud computing and provides a comparative analysis of their strengths and weaknesses. The models analysed include OCTAVE, CVSS, NIST, FAIR, CRAMM, STRIDE, and DREAD. Based on the analysis, the FAIR model is found to be the most suitable for cloud software, tailored to the characteristics of cloud computing.