A company deploying any kind of setup, cloud or not, while handling sensitive client data without having done any sort of risk assessment and due diligence is simply negligent and is a sitting duck. This does not require a fancy new term.