Good morning John, v.4 has been very fundamental for many organizations and its exciting that v.5 will build upon that. I think option #2 is very well aligned to how most companies align their security practices/programs. It will allow for both strategic alignment to overarching risk reduction efforts as well as tactical areas of focus on a team/program level. Cloud concepts and cloud related technologies could be subsections for each of the 5 high level areas since each of those would be unique per area of focus.
Happy to provide any additional information/feedback if it is valuable.