Regarding Point #1, I don't disagree with your general statement. But I do believe you need to point out that as the various service suppliers (i.e., remote-hosted/cloud solutions) move away from on-premise solutions, as IT Leaders for our company, we must ensure that any new service supplier with a remote IT solution will still meet our company's security requirements.

One needs to be very aware of the internal security of any remote IT solution and whether or not that service supplier can meet your security requirements. Reducing/removing on-premise solutions carries with it the need for increased knowledge of the remote IT supplier.