Operations is one thing, but security policies setting is another. The cloud provider can for example actively lie to you about having some security measures im

Operations is one thing, but security policies setting is another. The cloud provider can for example actively lie to you about having some security measures implemented, while it's not going to happen with your Wipro-like consulting firm, as these people just don't call the shots around the bank and are there typically only to execute procedures written on the bank side.