Yeah, exactly, its always possible to fail someone if ANYTHING is outsourced. Keep on digging digging digging. For example Amazon is PCIDSS level 1 and more than willing to provide docs to prove it, so if you need pcidss 1 or less, that "should" be OK. OK fine, keep digging. In more detail you can see AWS brags about having linked their HR system to their security system so when someone is terminated their security access is immediately automatically revokes. OK fine, keep digging. I demand to see the python script or whatever that they wrote and I'd like to examine the system logs on both sides to verify operation of that security system. Ah got them now. OK now I demand to read the source code for the BIOS of the computer that connects those two systems. Can't do it? You're now officially insecure, cancel the deal.

You can shut down deals that aren't outsourced by demanding more difficult stuff like viewing the manufacturing masks for the microcontrollers in the badge scanners. No not a generic mask for the CPU family or similar model of slightly different capacity, I mean the mask that was specifically used to make the specific chips in the individual badge scanners. You do audit that, don't you? Why can't I have the firmware to the chip in your usb keyboard, are you guys hiding something in there like a password grabber? Can you provide the source code of your on premises Cisco routers for our security review? Does Cisco know you can do that (LOL?)

Security is not a checkmark, its always been a spectrum, and if you want to torpedo a deal its always possible to crank up the demands until the other side quits. It may not be useful or provide a business advantage, but nothing is ever truly secure. Probably the AWS stuff is better than average, LOL.

Do you actually run a soc or iso certified data center? Because 99.9% of companies, even those who don’t use cloud services, use other people’s racks, cages, power, network etc for certified systems.

I do t think I know a single serious security professional that would raise an eye at using cloud resources. Quite the opposite, there is a fairly straightforward & repeatable process for securing cloud resources. Unlike on prem.

AWS has ISO27001 certification and more. The whole point of these certifications is that it proves a competent auditor came in and checked all of these things, so your customers don’t have too.

Part of ISO27001 is proving that you’re supply chain is also ISO27001 compliant. So picking companies that are already certified makes that easy, because then the certification naturally recurses down your supply chain.

AWS is ISO and SOC certified so they get audited on physical security. I can m trust that they dis it right because they passed their audit. I don't have time to go bother AWS about their security cameras and key card procedures.

And no auditor is going to ding you for noting that you have deferred the risk to them.

Certification allows you to form a chain of trust via providers who have had auditors validate and verify their security. When my company gets SOC2 audited, we don't have to audit AWS because AWS is also SOC2 compliant, and their business critical vendors are likewise or have been independently validated, etc. all the way down the chain.

I don't expect companies to hand out every detail about their security architecture. Security by obscurity is bad when it is the only thing you have, but it is an important part of the system as a whole.

I also wouldn't want deal with someone who tells me details that are not publicly available. If he tells me somebody else secrets, he will tell others my secrets.

There is no good answer to these questions except "this is not publicly available data".