Find out if security is a reactive part of the cloud provider's processes or if it is actively securing its systems. Smaller providers will have system administrators addressing security as issues pop up. Get customer references. Skills and certifications only go so far, said Sean Bruton, senior product manager at Hosting.com. Talk to the staff and generally get a feeling of their experience and knowledge.