The short answer is, not alone. Attestations outside of penetration testing reports, or the ability for an org (that desires to provision said provider's services) to run a vulnerability scan, are not acceptable.
As an individual who has provided internal security assessments, as well as many external, the scope of attestation much too often is extremely limited in scope. Therefore, these reviews do not provide an adequate benchmark of security &/or privacy compliance or posture.
So, kick the proverbial tires; while not requiring an expensive onsite audit....
