Could updated controls from NIST drive up cloud security costs?