This paper focuses on Security and Privacy for Small and Medium Enterprises pertaining to their dependency on small clouds to carry out their business activities. They lack the knowledge pertaining to the security to be applied to safeguard their data and services due to lack of in-house expert technical resources, security architects or less budgets to carry out the vulnerability study for them and to safeguard their data. Customers can rely on the services offered by the SMEs only if the hired services are secured. SMEs should have a proper understanding of the threats pertaining to the security aspect of the Software as a Service which they undertake. They should be able to investigate and asses the risk involved in showcasing their services on a cloud via the internet. The aim of this paper is to design a framework that brings out a Security & Privacy Architecture as a service for SMEs (SPAaaS) pertaining to Web Applications which can be offered by various security vendors. SPAaaS will assist the SMEs to evaluate the security requirements pertaining to host their data and services on cloud. © 2012 IEEE.