When organizations outsource their move their compute workloads to the cloud they assume that their cloud service provider will provide all the required assurances.

Service providers can only provide assurance for the compute they manage. Any components sitting on top of the compute are solely the responsibility of the customer.