You can assess a cloud vendor’s security posture in 30 minutes before you sign, if you read its published answers in the right order. Scope the review first, so you know which service the answers cover and what data and access the vendor will have. Then read its no answers, starting with the 10 controls vendors most often answer no, ask for independent evidence, and decide what to monitor after signing.
The order comes from the DigitalXForce Security Posture Benchmark 2026, which scored the published security answers of 2,112 companies in the CSA STAR Registry, retrieved on 26 August 2026. The median company reports 98.9% of its applicable controls in place, so almost all of those answers say yes and the no answers carry the signal.
What to have open before you start
Open the vendor’s entry in the CSA STAR Registry and download its latest Consensus Assessments Initiative Questionnaire (CAIQ), the file of yes, no and not applicable answers it publishes against the Cloud Controls Matrix. Open the benchmark’s provider check in a second tab. Note what data and access the vendor will have, because that decides how hard you read.
Minutes 0 to 5: scope the review
Write in your vendor record which service you are buying, what data the vendor will hold and what access it will have to your systems. Then confirm the CAIQ you downloaded covers that service, because a vendor can publish answers for one product and sell you another. The scope decides how hard you read the rest.
Minutes 5 to 15: read the no answers first
Filter the CAIQ for no answers and read them before any yes. In the DigitalXForce Security Posture Benchmark 2026, the median company reports 98.9% of its applicable controls in place, so a headline score separates almost no one. A no tells you something specific.
Start with the 10 controls companies most often answer no. Each share is of the companies in the benchmark that answered that question yes or no.
| Control | What it asks, in our words | Answering no |
|---|---|---|
| Customer-managed encryption keys (CEK-08.1) | Customers can manage their own data encryption keys. | 47.9% |
| Local authorities in continuity exercises (BCR-10.2) | Local emergency authorities take part in business continuity exercises where possible. | 35.8% |
| Data loss prevention on endpoints (UEM-11.1) | Managed endpoints run data loss prevention rules set by a risk assessment. | 20.9% |
| Location tracking on mobile devices (UEM-12.1) | Remote location tracking is switched on for every managed mobile device. | 20.3% |
| Equipment-based connection authentication (DCS-08.1) | Connections are authenticated by identifying the equipment that makes them. | 18.3% |
| Automated vulnerability remediation (AIS-07.2) | Fixing application security vulnerabilities is automated where possible. | 13.8% |
| Customer approval of privileged access (IAM-11.1) | Customers can take part in approving high-risk privileged access roles. | 13.8% |
| Governance of pre-activated keys (CEK-15.1) | Keys that exist but are not yet authorized for use are governed by defined processes. | 13.4% |
| Annual independent audit (A&A-02.1) | Independent audits against recognized standards run at least once a year. | 11.7% |
| Customer approval of provider changes (CCC-05.1) | Contracts limit provider changes to customer environments and require the customer’s explicit approval. | 11.3% |
Not every no is a weakness. Location tracking, local authorities in continuity exercises and equipment-based connection authentication are often deliberate design choices. On keys, ask whether you can bring or hold your own and what happens to them when the contract ends. On privileged access, ask who can approve access to your tenant and whether you are told when it happens.
Enter the vendor’s answers to these 10 controls in the provider check. It compares them with all 2,112 companies and shows what to ask next, and nothing you enter leaves your browser.
Minutes 15 to 25: ask for independent evidence
A CAIQ is the vendor’s own account. The Cloud Security Alliance describes STAR Level 1 as the level at which an organization submits the CAIQ to evaluate and document its own controls. Ask for evidence that someone independent has checked them, and confirm the evidence covers the service you are buying.
- CSA STAR Level 2. The STAR Certification is a third-party independent assessment built on ISO/IEC 27001, and the STAR Attestation is a SOC 2 engagement a CPA runs using AICPA criteria and the Cloud Controls Matrix.
- A SOC 2 Type 2 report. The AICPA’s illustrative Type 2 report includes the service auditor’s tests of controls and their results, so read the tests and note the report date.
- An ISO/IEC 27001 certificate. The standard defines the requirements an information security management system must meet. Check that an accredited body issued the certificate, and check its scope and expiry date.
In the DigitalXForce Security Posture Benchmark 2026, 11.7% of companies say they do not run independent audits against recognized standards at least once a year. Ask a vendor in that group when its controls were last audited.
Minutes 25 to 30: decide what to monitor after signing
A review before signing describes the vendor on one day. A published answer records what a vendor says on the day it answers, and it cannot show a change after that day. Use the last 5 minutes to write down what you will watch.
- Record the date you will ask for the vendor’s answers again.
- List each no you accepted and the contract term that covers it.
- Note the SOC 2 report date and the certificate expiry.
- Choose the outside-in signals you will watch, such as exposed services, breach reports and changes to the vendor’s domains.
This is the model DigitalXForce runs in its AI-Powered Third-Party Risk Management module, where the External Risk View watches each vendor from outside between reviews. IDC named DigitalXForce a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment (IDC document US53007725, September 2026), listed on the IDC research page.
When 30 minutes is enough, and when it is not
For a vendor with no sensitive data and no access to your systems, this review and a spreadsheet are enough. A team that signs a few cloud contracts a year does not need a third-party risk management platform, DigitalXForce’s included. A platform earns its place when the number of vendors outgrows the people monitoring them.
For a vendor that will run a critical service or hold regulated data, these 30 minutes are the first pass before a contract review and the fuller assessment in the guide to assessing the security of your cloud service providers. If your program still runs on annual questionnaires, read how to modernize a third-party risk program.
Questions buyers ask about cloud vendor assessments
What should I check first in a vendor’s published security answers?
Check that the answers cover the service you are buying, then read the no answers before the yes answers. In the DigitalXForce Security Posture Benchmark 2026 the median company reports 98.9% of its applicable controls in place, so the no answers carry the signal.
Is a no answer on a CAIQ a red flag?
A no answer is not always a red flag, because some are deliberate design choices. A no to customer-managed keys, customer approval of privileged access or annual independent audits deserves a direct question before you sign.
What is the difference between CSA STAR Level 1 and Level 2?
At Level 1 a company submits its own CAIQ answers. Level 2 adds an independent assessment: the STAR Certification builds on ISO/IEC 27001, and the STAR Attestation is a SOC 2 engagement run by a CPA.
Can customers manage their own encryption keys with most cloud vendors?
Many vendors do not allow it. In the DigitalXForce Security Posture Benchmark 2026, 47.9% of the 1,798 companies that answered the question say customers cannot manage their own data encryption keys, so ask every vendor directly.
What should I monitor after signing a cloud vendor?
Monitor the expiry of its audit evidence, the no answers you accepted and outside-in signals such as exposed services. A published answer cannot show a change after the day it was written, so change shows up in evidence collected between reviews.
Sources
- The DigitalXForce Security Posture Benchmark 2026 is at https://digitalxforce.com/research/security-posture-benchmark-2026/, built from CSA STAR Registry data retrieved on 26 August 2026.
- The Cloud Security Alliance describes STAR Level 1 and Level 2 at https://cloudsecurityalliance.org/star/levels, read on 24 September 2026.
- The AICPA describes its illustrative SOC 2 Type 2 report at https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion, read on 24 September 2026.
- ISO describes ISO/IEC 27001:2022 and certification to it at https://www.iso.org/standard/27001, read on 24 September 2026.
Do this once instead of every audit
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
