Shouldn't be. If I recall correctly, the process was fairly logical. One of the things you wrote down in your design doc was all the external surfaces (endpoints) your application/service had and how you were securing them.

You could literally not ship anything without this review, so they must have abandoned the process by now. Or just never extended it to "the cloud"