Cloud security posture assessment framework