10 questions CEOs should ask about cloud security