You can assess a cloud vendor’s security posture in 30 minutes before you sign, if you read its published answers in the right order. Scope the review first, so you know which service the answers cover and what data and access the vendor will have. Then read its no answers, starting with the areas vendors most often answer no, ask for independent evidence, and decide what to monitor after signing.
The order comes from the DigitalXForce Security Posture Benchmark 2026, which scored the published security answers of 2,112 companies in the CSA STAR Registry, retrieved on 26 August 2026. The same data is answered question by question: which security areas providers most often lack and how company size changes the picture. The median company reports 98.9% of its applicable controls in place, so almost all of those answers say yes and the no answers carry the signal.
What to have open before you start
Open the vendor’s entry in the CSA STAR Registry and download its latest Consensus Assessments Initiative Questionnaire (CAIQ), the file of yes, no and not applicable answers it publishes against the Cloud Controls Matrix. Open the benchmark’s ranking of the 17 domains in a second tab. Note what data and access the vendor will have, because that decides how hard you read.
Minutes 0 to 5: scope the review
Write in your vendor record which service you are buying, what data the vendor will hold and what access it will have to your systems. Then confirm the CAIQ you downloaded covers that service, because a vendor can publish answers for one product and sell you another. The scope decides how hard you read the rest.
Minutes 5 to 15: read the no answers first
Filter the CAIQ for no answers and read them before any yes. In the DigitalXForce Security Posture Benchmark 2026, the median company reports 98.9% of its applicable controls in place, so a headline score separates almost no one. A no tells you something specific.
Start with the areas companies most often answer no. Each share is a share of the companies in the benchmark that answered at least one question in that Cloud Controls Matrix domain.
| Domain | Companies answering | Reporting at least one no |
|---|---|---|
| Cryptography, Encryption and Key Management | 2,098 | 52.0% |
| Universal Endpoint Management | 2,067 | 36.7% |
| Business Continuity and Operational Resilience | 2,110 | 33.6% |
| Identity and Access Management | 2,109 | 25.0% |
| Datacenter Security | 2,041 | 24.4% |
| Supply Chain Management and Transparency | 2,101 | 22.9% |
Not every no is a weakness, because some answers reflect design choices that many sound companies make on purpose. On encryption, ask who holds the keys, whether you can bring or hold your own and what happens to them when the contract ends. On identity and access, ask who can approve access to your tenant and whether you are told when it happens.
Compare the rest of the vendor’s no answers with the full ranking of all 17 domains in which security areas cloud providers most often report as not in place.
Minutes 15 to 25: ask for independent evidence
A CAIQ is the vendor’s own account. The Cloud Security Alliance describes STAR Level 1 as the level at which an organization submits the CAIQ to evaluate and document its own controls. Ask for evidence that someone independent has checked them, and confirm the evidence covers the service you are buying.
- CSA STAR Level 2. The STAR Certification is a third-party independent assessment built on ISO/IEC 27001, and the STAR Attestation is a SOC 2 engagement a CPA runs using AICPA criteria and the Cloud Controls Matrix.
- A SOC 2 Type 2 report. The AICPA’s illustrative Type 2 report includes the service auditor’s tests of controls and their results, so read the tests and note the report date.
- An ISO/IEC 27001 certificate. The standard defines the requirements an information security management system must meet. Check that an accredited body issued the certificate, and check its scope and expiry date.
In the DigitalXForce Security Posture Benchmark 2026, 14.5% of companies report at least one control not in place in the Audit and Assurance domain. Ask a vendor in that group when its controls were last audited.
Minutes 25 to 30: decide what to monitor after signing
A review before signing describes the vendor on one day. A published answer records what a vendor says on the day it answers, and it cannot show a change after that day. Use the last 5 minutes to write down what you will watch.
- Record the date you will ask for the vendor’s answers again.
- List each no you accepted and the contract term that covers it.
- Note the SOC 2 report date and the certificate expiry.
- Choose the outside-in signals you will watch, such as exposed services, breach reports and changes to the vendor’s domains.
This is the model DigitalXForce runs in its AI-Powered Third-Party Risk Management module, where the External Risk View watches each vendor from outside between reviews. IDC named DigitalXForce a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment (IDC document US53007725, September 2026), listed on the IDC research page.
When 30 minutes is enough, and when it is not
For a vendor with no sensitive data and no access to your systems, this review and a spreadsheet are enough. A team that signs a few cloud contracts a year does not need a third-party risk management platform, DigitalXForce’s included. A platform earns its place when the number of vendors outgrows the people monitoring them.
For a vendor that will run a critical service or hold regulated data, these 30 minutes are the first pass before a contract review and the fuller assessment in the guide to assessing the security of your cloud service providers. If your program still runs on annual questionnaires, read how to modernize a third-party risk program.
Questions buyers ask about cloud vendor assessments
What should I check first in a vendor’s published security answers?
Check that the answers cover the service you are buying, then read the no answers before the yes answers. In the DigitalXForce Security Posture Benchmark 2026 the median company reports 98.9% of its applicable controls in place, so the no answers carry the signal.
Is a no answer on a CAIQ a red flag?
A no answer is not always a red flag, because some are deliberate design choices. A no in the encryption and key management, identity and access management or audit and assurance domains deserves a direct question before you sign.
What is the difference between CSA STAR Level 1 and Level 2?
At Level 1 a company submits its own CAIQ answers. Level 2 adds an independent assessment: the STAR Certification builds on ISO/IEC 27001, and the STAR Attestation is a SOC 2 engagement run by a CPA.
Which area of a vendor’s published answers should I read first?
Start with encryption and key management. In the DigitalXForce Security Posture Benchmark 2026, 52.0% of companies report at least one control in that domain not in place, the highest share of the 17 domains, so ask every vendor directly who holds the encryption keys.
What should I monitor after signing a cloud vendor?
Monitor the expiry of its audit evidence, the no answers you accepted and outside-in signals such as exposed services. A published answer cannot show a change after the day it was written, so change shows up in evidence collected between reviews.
Sources
- The DigitalXForce Security Posture Benchmark 2026 is at https://digitalxforce.com/research/security-posture-benchmark-2026/, built from CSA STAR Registry data retrieved on 26 August 2026.
- The Cloud Security Alliance describes STAR Level 1 and Level 2 at https://cloudsecurityalliance.org/star/levels, read on 24 September 2026.
- The AICPA describes its illustrative SOC 2 Type 2 report at https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion, read on 24 September 2026.
- ISO describes ISO/IEC 27001:2022 and certification to it at https://www.iso.org/standard/27001, read on 24 September 2026.
Do this once instead of every audit
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
