How to Assess the Cybersecurity of Your Cloud Software Providers

Cloud software now runs accounting, payroll, document storage, customer management, and communication for businesses of every size. That convenience moves your data onto someone else’s systems, but it does not move your responsibility for it. Regulators in the US, EU, and UK expect organisations to oversee their vendors, and clients expect the same. A provider’s breach can trigger notification duties, fines, and lost trust even if the attack never touched your own network. This guide breaks down the exact steps to assess your cloud providers so you can protect your data and scale your success without the stress.

Key Takeaways

Here is a quick look at the main things you will learn in this guide:

Why you stay accountable for data held by cloud vendors, and which US, EU, and UK expectations apply
How to sort vendors by risk so your effort goes where it matters most
How to read SOC 2, ISO 27001, and other assurance reports beyond the headline
Which security questions, contract terms, and red flags to look for before you sign
How to keep monitoring vendors after onboarding

Why Cloud Vendor Security Is Your Security
Know the Regulatory Expectations
Classify Vendors by Risk
Review Independent Assurance Reports
Ask the Right Security Questions
Verify Claims, Do Not Just Trust Them
Build Security Into the Contract
Monitor Vendors Continuously
Red Flags to Watch For
Your Vendor Assessment Checklist
Conclusion
FAQs

Why Cloud Vendor Security Is Your Security

Cloud security works on a shared responsibility model. The provider secures its infrastructure and application, while you control who accesses your account, how it is configured, and what data you put in it. If a vendor is compromised, though, it is usually your clients, employees, and customers whose information is exposed, and it is you who must explain what happened.

That is why regulators and auditors focus on vendor oversight. Being the data owner or controller means you remain accountable for the choices you make about who processes your data. Weak vendor checks are also one of the easiest gaps for an attacker to exploit, because a single provider can give access to hundreds of customers at once. A structured assessment process reduces that risk and gives you evidence that you exercised reasonable care.

Know the Regulatory Expectations

Requirements depend on where you operate and what data you hold. Confirm the current position with the relevant authority or a qualified adviser before relying on any point below.

United States

Tax and accounting professionals are treated as financial institutions under the FTC Safeguards Rule, which requires them to select capable service providers, require safeguards by contract, and periodically assess them. IRS guidance, such as Publication 4557 on safeguarding taxpayer data and the written information security plan template in Publication 5708, points in the same direction. Public companies must describe how they manage material cyber risks, including risks from third-party service providers, in their SEC filings.

State law adds another layer. All 50 states have data breach notification laws, and some go further. California’s privacy law requires specific contract terms with service providers, Massachusetts requires reasonable steps to select and retain capable service providers, and New York’s financial services cybersecurity regulation requires a third-party service provider security policy for covered entities. Sector rules such as HIPAA business associate agreements and PCI DSS can also apply.

European Union

Under the GDPR, controllers must use processors that provide sufficient guarantees (Article 28), apply appropriate security (Article 32), and notify the supervisory authority of breaches within 72 hours of becoming aware (Article 33). Processors must tell you about a breach without undue delay. Fines can reach EUR 10 million or 2% of worldwide turnover for security and processor failures, and EUR 20 million or 4% for the most serious violations, such as unlawful data transfers.

Two more EU rules matter for many organisations. The NIS2 Directive requires in-scope entities to manage supply chain security, though national implementation varies. The Digital Operational Resilience Act (DORA), which has applied since January 2025, sets detailed ICT third-party risk and contract requirements for financial entities.

If your vendor is based in the US, check the transfer mechanism. The EU-US Data Privacy Framework is currently valid, but an appeal is pending at the EU Court of Justice, so confirm that your vendor also offers Standard Contractual Clauses as a fallback.

United Kingdom

UK GDPR and the Data Protection Act 2018 mirror the EU’s supplier and security duties, with fines of up to GBP 8.7 million or 2% of turnover for security failures, and GBP 17.5 million or 4% for the most serious breaches. The National Cyber Security Centre publishes 14 Cloud Security Principles that many organisations use as an assessment framework, and Cyber Essentials certification is a useful baseline signal. Software that connects to HMRC’s systems must also meet HMRC’s requirements, such as fraud prevention headers.

Classify Vendors by Risk

You cannot review every vendor in depth, so tier them by the damage a failure would cause. Consider five factors: the sensitivity of the data, the level of access or integration, how critical the service is to daily operations, your regulatory exposure, and how hard the vendor would be to replace.

Then apply proportionate effort:

Tier 1, critical: Vendors that hold client, payroll, tax, financial, or health data, or whose outage would stop core operations. Examples include accounting, payroll, tax, and document management platforms. These get full due diligence and annual reviews.
Tier 2, moderate: Vendors that hold limited business data or connect to your systems in a restricted way. These get a shorter questionnaire and a review of their assurance report.
Tier 3, low: Vendors with no sensitive data and easy replacement, such as a scheduling app. These get a basic check of security settings and terms.

Keep a central register of all vendors with their tier, data types, owners, and renewal dates. It is the foundation for every later step.

Review Independent Assurance Reports

Independent reports show what a vendor has actually been tested against. They are valuable, but only when you read them properly.

SOC 2 and SOC 1 Reports

A SOC 2 report, issued by an independent CPA firm under AICPA standards, evaluates controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Check these points:

Type II, not just Type I: Type I looks at design at a single date, while Type II tests whether controls worked over a period, commonly 6 to 12 months.
Scope: Confirm that the report covers the actual product, environment, and locations you use.
Report period: A report that ended more than a year ago is stale, so ask for a bridge letter covering the gap.
Opinion and exceptions: Read the auditor’s opinion and every noted exception, along with management’s response.
Subservice organisations: Find out which critical providers, such as the hosting platform, are covered or carved out.
Complementary user entity controls: These are the controls the report expects you to operate yourself, such as managing user access.

A SOC 1 report is more relevant when the vendor’s system affects your financial reporting, for example payroll or billing platforms.

ISO 27001 and Related Certificates

An ISO/IEC 27001 certificate shows that an accredited body has audited the vendor’s information security management system. Check the scope statement to see which services and sites are included, and ask for the Statement of Applicability. Related standards such as ISO 27017 for cloud security and ISO 27018 for personal data in the cloud add useful detail.

Other Useful Evidence

The Cloud Security Alliance’s STAR registry and its standard questionnaire offer another view of a vendor’s controls. Vendors serving US government customers may hold FedRAMP authorisation or equivalent state programme approval. UK vendors may hold Cyber Essentials Plus. A vendor’s mapping to the NIST Cybersecurity Framework can help you compare providers on a consistent basis.

Ask the Right Security Questions

Use a standard questionnaire, such as an industry template, or a short custom list. Cover these areas:

Access control: Is multi-factor authentication available and enforceable for all users? Are single sign-on and role-based permissions supported? How is vendor staff access to your data limited and logged?
Encryption: Is data encrypted in transit with current TLS versions and at rest with strong encryption? Who manages the keys, and can you use your own?
Data location: In which countries is data stored, backed up, and accessed? Which transfer mechanism applies to EU or UK personal data?
Application and network security: How often does an independent firm perform penetration tests? What is the patching timeline for critical vulnerabilities? Is there a secure development process?
Logging and monitoring: Are audit logs available to you, and for how long are they kept? Is activity monitored around the clock?
Incident response: Is there a tested plan? How quickly will you be notified, and what has the vendor learned from past incidents?
Continuity: What are the recovery time and recovery point objectives? How often are backups and disaster recovery tested? What is the uptime commitment?
Subprocessors: Who are they, how are they vetted, and how will you be told about changes?
People: Are background checks and security training required for staff with access to systems?
Data lifecycle: What are the retention rules, and how is your data returned and deleted when the contract ends?

Verify Claims, Do Not Just Trust Them

Answers on a questionnaire are claims, not proof. Ask for evidence wherever the risk justifies it. Request a summary of the latest penetration test and how findings were fixed, review the vendor’s trust or security page, and ask to see policies on access, incident response, and data deletion. During a trial or demo, test the controls yourself: enforce multi-factor authentication, set up roles with limited permissions, and confirm you can export audit logs.

Speak to existing customers of similar size and sector, and search for the vendor’s security incident history and how it responded. Note how quickly and clearly the vendor answers your questions, since a slow or evasive reply during sales rarely improves after signing. Also consider the vendor’s financial stability, because a provider that fails or is acquired can put your data and service at risk.

Build Security Into the Contract

Security promises that are not in the contract are hard to enforce. Look for these terms:

Data processing terms: For personal data, a data processing agreement that meets GDPR Article 28 or equivalent service-provider terms under US state law
Minimum security controls: A security schedule that lists encryption, access control, testing, and logging commitments
Breach notification: A specific deadline, such as 24 to 72 hours from discovery, with details about what the vendor must share
Audit and assessment rights: Access to assurance reports and, for critical vendors, the right to request further evidence
Subprocessor controls: Advance notice of changes and the right to object
Data location and transfers: Approved regions and valid transfer mechanisms
Liability and insurance: Meaningful liability for data breaches and evidence of cyber insurance
Exit terms: Data return in a usable format, secure deletion with confirmation, and reasonable transition help
Termination rights: The ability to leave if the vendor suffers a serious security failure

Pay close attention to liability caps. If you pay EUR 24,000 a year and the vendor’s liability is capped at 12 months of fees, your recovery after a serious breach would be EUR 24,000 at most, far below typical response, notification, and legal costs. Finance teams should also consider how cloud contract costs are accounted for, such as implementation costs under ASC 350-40 for US GAAP entities and subscription-based IT arrangements under GASB Statement No. 96 for US governments, and involve their auditors early.

Monitor Vendors Continuously

Assessment is not a one-time event. Build a light but routine:

Reassess on a schedule. Review Tier 1 vendors every year, Tier 2 every two years, and any vendor after a major incident, acquisition, or service change.
Track assurance reports. Diarise the renewal of SOC 2 and ISO certificates, and request new reports and bridge letters promptly.
Watch subprocessor and policy changes. Review notices and confirm they remain acceptable.
Follow security notices. Assign someone to read vendor advisories and act on required configuration changes.
Review your own user access. Every quarter, remove leavers, check admin rights, and confirm multi-factor authentication is on.
Test your exit plan. Confirm you hold recent exports of your data and know how to switch providers if you must.

Red Flags to Watch For

Pause the process if you see any of these:

No independent assurance: The vendor offers only marketing claims and refuses to share any report under a confidentiality agreement.
No multi-factor authentication: Or it is optional only for some users or plans.
Vague breach commitments: No clear notification deadline or contact process.
Unclear data location: The vendor cannot say where your data is stored or who can access it.
No independent testing: No recent penetration test or vulnerability management process.
Old or heavily qualified reports: A report period that ended long ago or many unresolved exceptions.
Uncontrolled subprocessors: Changes made without notice or your ability to object.
No deletion process: No clear way to retrieve and erase your data when you leave.
Shared administrator accounts: Weak internal access practices are a sign of weak controls generally.
Pressure and evasion: Urgent deadlines, or reluctance to answer basic security questions.

Your Vendor Assessment Checklist

Use this order for every new vendor and every renewal:

Classify: Assign a risk tier based on data, access, and criticality.
Confirm obligations: Identify the US, EU, and UK rules that apply to your data.
Collect evidence: Obtain the latest SOC 2, ISO 27001, or equivalent reports, and read scope, period, and exceptions.
Ask questions: Complete a security questionnaire proportionate to the tier.
Verify: Test key controls in a trial, and review penetration test summaries and references.
Contract: Include security, breach notification, audit, subprocessor, liability, and exit terms.
Onboard securely: Configure multi-factor authentication, roles, and logging before adding real data.
Monitor: Schedule reassessments, report renewals, and quarterly access reviews.

Conclusion

Assessing a cloud provider comes down to a few habits: know your obligations, classify vendors by risk, read the evidence rather than the marketing, put security in the contract, and keep checking after you sign. You do not need a large team to do this well. A short, consistent process applied to your most important vendors will remove most of the risk. One final thought: start with your top five providers, the ones that hold your most sensitive data, and complete the checklist for each of them this quarter. That single step will tell you more about your real exposure than any policy document.

FAQs

How often should I reassess cloud vendors?

Review critical vendors at least once a year, and lower-risk vendors every two to three years. Also reassess after a security incident, an acquisition, or a major change in the service or data you share.

Is a SOC 2 report enough on its own?

No. It is a strong starting point, but you still need to check the scope, period, and exceptions, and combine it with a questionnaire, contract terms, and ongoing monitoring.

What if a small vendor has no certifications?

That is not automatically disqualifying. Ask for alternative evidence such as a recent penetration test, security policies, multi-factor authentication, encryption details, and incident history. Limit the data you share and tighten the contract terms.

Who is responsible if a vendor is breached?

Usually you remain accountable to regulators and your clients as the data owner or controller, although the contract may allow you to recover costs from the vendor. That is why oversight and contract terms matter.

Do these expectations apply to small businesses and accounting firms?

Yes. US tax and accounting professionals fall under the FTC Safeguards Rule and IRS guidance, and the GDPR applies to organisations of any size that handle EU personal data. The depth of your process can scale with your size, but the duty to oversee vendors does not disappear.

Can I use a US cloud provider for EU personal data?

Yes, provided a valid transfer mechanism is in place, such as certification under the EU-US Data Privacy Framework or Standard Contractual Clauses. Because the framework faces an appeal, confirm that your vendor can rely on Standard Contractual Clauses if needed.

How to Build a Written Information Security Plan for a Small Accounting Firm
Multi-Factor Authentication: A Practical Guide for Small Businesses
How to Respond to a Data Breach: A Step-by-Step Guide for US and EU Businesses