Questions to ask a cloud consultant

Cloud consultancies and compliance consultancies both sell cloud compliance. Some can harden an AWS account and not write a policy; others the reverse. These questions find out which you are talking to.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Ask every firm the same twelve questions and compare the answers side by side. A good firm answers specifically, names what it will not do, and asks you questions back about scope. Vague answers and fixed prices before any scoping are the warning signs.

The questions and what good answers sound like

Which cloud providers do your people work in every week?

A good answer names the providers and the certifications of the people on your engagement. Be wary of "all of them equally". Timing: ask on the first call. Evidence: named practitioners and their provider certifications.

Will you change our cloud configuration, or only advise?

Either is legitimate, but you need to know. If they change configuration, ask how changes go through your pipeline and approvals. Common mistake: assuming advice includes implementation.

How will you map our cloud controls to SOC 2 criteria or ISO 27001 Annex A?

Expect a control matrix: control, owner, frequency, evidence, criteria. Ask to see an anonymized example. Evidence: a sample matrix.

What evidence will our cloud produce automatically, and what will we collect by hand?

A good firm names the native tools (Config, Security Hub, Azure Policy, Defender, SCC) and admits what stays manual: access reviews, restore tests, triage records.

Do you have a relationship with an audit firm, and how is independence handled?

Introductions are normal. The firm that builds your controls cannot audit them. Walk away from anyone offering both. Canadian note: CPA independence rules apply to Canadian audit firms.

What will you need from our engineers, in hours per week?

An honest estimate, usually two to eight hours a week from a platform engineer during hardening. "Almost nothing" means the work will not happen.

How do you handle Canadian data residency and Law 25?

They should know the Canadian regions, location policies and when a Law 25 transfer assessment is needed. Data residency in Canada is the background.

Do you recommend a compliance platform, and do you earn a referral fee?

Ask directly. A referral arrangement is not disqualifying if disclosed and if they can explain when you do not need a platform.

How do you price, and what is excluded?

Fixed scope with named deliverables, or a day rate with an estimate. Exclusions stated in writing. Typical range: $12,000 to $40,000 CAD for readiness, $8,000 to $30,000 CAD for account hardening.

What happens if the auditor raises a finding in an area you prepared?

A good firm supports remediation and fieldwork questions within the engagement, or states the rate for it up front.

Who will actually do the work?

Names and roles. The person on the sales call is often not the person in your account.

Can we speak to a client with a similar cloud estate?

Reference calls are reasonable for a five-figure engagement. A firm new to the market may not have one; weigh that against the rest of the answers.

Red flags

• A fixed price before seeing your accounts.
• An offer to both prepare and audit you.
• A guarantee that you will pass.
• Asking for standing administrator access instead of a scoped role.
• A platform bundled in with no explanation of why you need it.

What to do next

Send the same questions to three firms, compare the written answers, and check scope and exclusions line by line. Firms that do this work are in the directory, and the quote form sends your scope to firms that match.