An organization is migrating a customer-facing application to a public cloud provider using an Infrastructure-as-a-Service (IaaS) model. During the risk assessment, the risk practitioner notices that the project team assumes the cloud provider will handle all security patching, including the guest operating systems and application layers. Which action should the risk practitioner recommend FIRST to address this concern?