Is cloud storage secure for your business?

Start with shared responsibility for cloud security

The cloud provider is responsible for the platform, but the company is responsible for accounts, roles, sharing, retention, integrations, data classification and incident response. Therefore, the decision about the cloud does not end with choosing Microsoft 365, Google Workspace, Azure or another SaaS service. You need to define data owners, access rules, applicable GDPR, NIS2 or DORA requirements, and evidence that the controls work. MFA, retention, logging and independent backup must follow the data across Microsoft 365, Google Workspace and other SaaS services instead of relying on the provider name as proof of safety.

Decision map before migrating or tidying up the cloud

Before migration, it is worth answering a few management questions. Without them, the cloud quickly becomes a collection of exceptions, public links, old accounts and integrations that no one controls.

• What data is critical, confidential or covered by customer, audit, GDPR, NIS2 or DORA requirements?
• Who owns the data and who approves external access, public links and exceptions?
• What accounts are privileged and does every admin login require MFA?
• How long must data be retained or archived, and when must it be deleted after the relationship ends?
• How quickly does a company need to recover a mailbox, folder, file or entire process after an error, attack or failure?

Top cloud data security checks

Good configuration isn't about turning on one feature. It is a set of controls that together reduce the risk of data loss, unauthorised access and lack of evidence after an incident. The minimum scope should cover both daily administration and emergency scenarios: account loss, ransomware, administrator error, employee departure, dispute with a contractor and the need to quickly restore data.

• MFA for users and administrators, with separate accounts for privileged activities.
• The principle of least privileges, role groups and periodic access reviews.
• Restrict public links and control external sharing and guest access.
• Retention, archiving, DLP and a clear process for deleting data upon completion of the processing purpose.
• Backup independent of the recycle bin and platform retention, with a data recovery test.
• Logs and alerts for unusual logins, bulk file downloads and permission changes.

The most common mistakes that reduce cloud security

In practice, the problem is rarely the cloud itself. Risk is created by rushing, lacking process owners, and assuming that the service provider automatically solves all security scenarios. Typical failures include former employees retaining access, sensitive folders shared publicly, insufficient audit-log retention and the recycle bin being mistaken for backup. Without an owner and tested export path, account takeover, accidental deletion or a supplier outage can leave the company unable to prove what was exposed or recover data on time.

Deliverables after cloud data audit

The audit should end with materials that can be used during implementation, management review and conversation with the auditor. Screenshots from the administration panel alone will not be enough if you don't know who approves access, how long the data is stored and whether the backup actually works. A clear operating model exposes dormant administrators, public links, unmanaged guests and missing copies before they lead to disclosure or downtime. The cloud provider protects its platform, but the customer still controls identities, sharing, retention and recovery.

• Map of critical data, repositories, owners, access groups and administrative accounts.
• List of risks: public links, guests, no MFA, unclear retention, no backup and redundant roles.
• Report on the selected data recovery test and conclusions for the RPO/RTO.
• Phased change plan with priorities for Microsoft 365, backup, logs and access process.

How Virtline helps secure data in the cloud

Virtline combines Microsoft 365 administration, backup, cybersecurity and ongoing IT support. This allows recommendations to be translated into configurations, procedures, reports and audit evidence. We work with companies that want to organise data after migration, prepare for a customer audit or reduce the risk of an incident without stopping users' work.

How to turn this into an action plan

Start with one cloud platform and one sensitive data flow. Confirm its owner, administrators, external sharing, retention, logs and recovery route. That small scope is enough to expose whether the next decision is an access cleanup, backup test, tenant review or broader cloud-governance project.

How does a cloud data security project work?

First classify data, assign owners and review accounts, sharing, retention, logs, backups and data export. Address urgent gaps immediately. Required safeguards and a successful recovery test must be in place before production data moves. The dates below are example progress reviews, not dates for starting protection.

• 30-day review: confirm service scope, privileged accounts, MFA, sharing and reduction of urgent gaps.
• 60-day review: assess the effectiveness of roles, alerts, retention and procedures for granting and revoking access.
• 90-day review: repeat recovery and export tests, review risks, exceptions and documentation, and schedule further checks.

Cloud data control areas

Cloud security depends on a clear division of responsibility. The provider protects the platform, while the company controls identities, data, continuity and operating evidence.

• identity: MFA, administrator accounts, conditional access and recurring role review
• data: classification, retention, DLP, encryption and restricted public links
• continuity: independent backup, restore tests, RPO/RTO and escalation procedure
• evidence: logs, alerts, approved exceptions and recurring reports for data owners

When does the cloud need an urgent review?

Consider a review after migration, administrator changes or before a customer audit. It is particularly useful for organisations handling sensitive data across multiple SaaS services, locations or providers. Check old accounts, access exceptions, permission owners and recovery-test results.

What evidence should remain after implementation?

After implementation, the company should retain scope, decisions, configurations, owners, open risks, test results and review dates. This evidence supports management, audits, customer requirements and ongoing operations. Documentation should stay practical: administrators and decision makers must be able to use it, not only store it. Virtline focuses on clear priorities and concrete next steps.

• Scope of services, repositories, critical data and accepted exceptions.
• Configurations, roles, owners and decisions concerning access and retention.
• Results of MFA, alert, backup and recovery tests, including RPO/RTO evidence.
• Open risks, deadlines, accountable owners and dates of the next reviews.

How does control stay current?

Recheck cloud controls when a service, integration, administrator, data class, sharing rule or retention setting changes. Account and guest reviews can run monthly or quarterly, while restore, export and incident paths need scheduled tests. Exceptions remain visible only when they have an owner, expiry date and a trigger for reassessment.

• Review accounts, roles, guests and public links after every material change.
• Reassess new services, data, devices and suppliers before production use.
• Repeat restore tests and verify alerts and escalation paths on schedule.
• Report exceptions and risks to business owners in an agreed rhythm.

Related topics

Cloud security should be integrated with MFA, ongoing IT operations and formal security requirements.

Acceptance criteria for cloud data security

Acceptance names the covered services and data classes, confirms reviewed administrators, guests and public links, and records effective MFA, retention and event logging. A selected restore or export and an alert escalation must succeed. Each exception has an owner, expiry date and explicit risk decision.

• The scope of systems, data and integrations is agreed and documented.
• MFA, permissions, sharing, retention and alerts have been verified.
• Backup and recovery of selected data passed a documented test.
• Exceptions have an owner, risk decision and review date.
• Documentation, escalation and the review rhythm were handed over to operations.

Contact

During the consultation, we collect the service list, critical data, administrators, current backups and RPO/RTO requirements. The result is a short, prioritised action list covering MFA, roles, backup, retention, logs and recovery evidence.

• Prepare a list of cloud services and accountable data owners.
• Collect the latest recovery-test results and known access exceptions.
• Call +48 12 200 27 10 to define the review scope.