The government relies, in part, on third-party firms to vet cloud technology, but those firms are hired and paid by the company being assessed.