Can you do this yourself?

Every question below came out of an engagement one of us ran, and every one of them has been answered wrong in production by a competent team. Answer all ten and you should keep this in-house — that is a real answer, not a setup. A no is not a failing grade either. It is the thing worth writing to us about, because it is the thing we would start on.

Can you name every account in your cloud organization and who owns it? Not the ones in the diagram. All of them, including the one someone opened for a proof-of-value in 2023. We governed access across 50+ accounts at a top-5 US bank and the inventory was the first week’s work.
Can you produce evidence for your access-review control today, without a scramble? An assessor asks who approved which entitlement, and when. The answer is a query or it is a week.
Has anyone executed a cross-region failover in the last 30 days? Not tested the runbook. Run it. On a payments platform the failover tests were monthly and automated, against 30+ documented failure scenarios, and the recovery objective they were held to was under a minute.
Do you know which of your running images carry a KEV-listed CVE right now? Scanners answer a version of this in the thousands. The company-wide program we built at an NDA platform scored on CVSS and EPSS so the list came back short enough to act on.
Is your IAM boundary the one you designed, or the one that accumulated? Every emergency grant that was never revoked is a finding with a name on it.
If your platform lead resigned this month, could someone else deploy? The Terraform, the pipeline, and the on-call rotation either belong to the team or to one person.
Was your SLO set from traffic you watched, or from a number that sounded right? We set autoscaling thresholds against payment throughput rather than CPU, and peak hit 3x normal load without a stalled payment.
Are your controls described somewhere an auditor can read, written during the build? Assembled the week the assessor arrives is the expensive version, and it is the common one.
Do you know what your inference API is allowed to return, and who can reach the training data? If there is a model in production and nobody owns those two answers, that gap is somebody’s job and currently nobody’s.
When something broke last quarter, did the postmortem change any architecture? A finding nobody can act on is a liability with a cover page, whether a vendor wrote it or you did.

Answering yes down the whole list means your team has already done the expensive half, and a firm selling you the cheap half is selling you nothing. That happens, and we would rather you worked it out here than four weeks into a proposal.