How should I structure a third-party risk assessment for our new cloud vendors given that our security team is only two people?