Security is a fundamental concern in clouds and several cloud vendors provide Security Reference Architectures (SRAs) to describe the security level of their services. A SRA is an abstract architecture without implementation details showing a conceptual model of security for a cloud system. In general, Reference Architectures (RAs) are becoming useful tools to understand and build complex systems. We propose here a Security Reference Architecture (SRA), defined using UML models and patterns, incorporating a specific approach to build secure systems. We present a metamodel and possible patterns to conceptualize the approach. We also describe some uses for this SRA, including its value for Service Level Agreements (SLAs), service certification, monitoring, and security evaluation. We show this latter use in some detail. Copyright © 2014 ACM 978-1-4503-2523-3/14/04⋯$15.00.