The two findings sit on different planes, which is why both hold at once. Surviving an outage or an attack at one provider is an availability property [6]. What NIST says degrades is the control plane: consistent security policy, uniform controls and enforced authentication, measured against a single cloud or an on-premises estate [4]. An estate can become more available and less governable in the same procurement cycle, and the bar for entry is low, since NIST counts two providers as multi-cloud [3].
Read the specific items and a pattern surfaces. At least five of the failures NIST describes are not customer misconfigurations. Customers may be unable to run their own vulnerability scans, lacking direct access to provider systems [10]. Incident data may arrive late or incomplete, and in each provider's own reporting format and schema [11]. The administrative privileges needed to monitor services independently may not be granted [12]. Contingency planning policies are frequently withheld on backend-security grounds, and the results of disaster recovery tests are typically not offered [13]. Security documentation from every provider in the chain may simply not be obtainable [15]. Each of those sits on the provider's side of the line [2].
That asymmetry is what makes NIST's own remedy list awkward. Governance frameworks, centralized visibility, consistent policy enforcement, automation and standardization [16] are all things the customer buys, staffs and runs. Automation normalizes data after it arrives, and NIST is explicit that vulnerability reports turn up on different clocks in different formats, which it says makes a uniform patch management approach impossible across an enterprise architecture [9]. A pipeline cannot standardize a report that was never sent.
The assurance boundary also runs deeper than the contracts on file. NIST notes the verification problem is worsened by the need to check the access control policies and implementations of the other vendors and third parties that the providers themselves use [8]. Compliance exposure works the same way: inconsistent encryption across providers puts the customer at risk of breaching data protection rules in the jurisdictions it operates in [14], while the paperwork that would show otherwise belongs to someone else.
Set the two halves of the report against each other and the ledger reads one named cybersecurity advantage against 23 identified challenges [1]. That ratio is not a verdict on running two clouds. It is a measure of how much of the architecture currently has no agreed answer, which is presumably why the document is addressed to the security community rather than to auditors.
