Skip to content
“Our data is in the cloud” usually means a specialist provider is operating the infrastructure that stores and delivers it. That can bring strong availability, redundancy and access from different locations.
It does not automatically guarantee that the right people have access, the information is being used correctly, every deletion can be reversed, or the business can continue through every kind of disruption.
The cloud solves important infrastructure problems
For many small businesses, cloud services remove the need to run and maintain their own server infrastructure. Providers can spread services and data across resilient systems, monitor them continuously and recover from many underlying hardware or software failures without the customer needing to intervene.
Microsoft 365, for example, is designed with multiple copies, fault isolation and built-in recovery features to protect service availability and critical customer data.
That is real value. The mistake is turning “highly resilient” into “nothing else needs managing”.
The provider and the business still have different jobs
The exact split depends on the service being used. With a fully managed application, the provider may look after almost everything below the application itself. The business still needs to decide whether the service is suitable, configure it appropriately, choose what information belongs there and control who can use it.
The provider cannot know whether a former employee still has unnecessary access, whether a confidential file has been shared too widely or whether staff are working from the correct version of a document.
Cloud services provide capabilities. The business still determines how those capabilities are used. The NCSC describes this as a shared responsibility whose precise division varies according to the service and provider.
Availability is not the same as continuity
A cloud platform may be working perfectly while an employee cannot reach it because their identity has been compromised, their laptop has failed or the office connection is unavailable.
Data may also exist within the service but not be recoverable in the way or timescale the business expects. Version histories, recycle bins, retention controls and backups solve different problems. None should be assumed to meet the organisation’s recovery needs without being understood and tested.
The cloud can strengthen resilience, but it does not create a complete resilience plan by itself.
Ask a more useful set of questions
Instead of stopping at “Is our data in the cloud?”, ask:
- Which service holds the authoritative copy?
- Who can access it, and under what conditions?
- What protection and recovery options are included?
- Do those options match how quickly we need to recover?
- How would people keep working if the service, identity, device or connection became unavailable?
- Can we retrieve the information in a usable form if we change provider?
A useful question for a small business is:
Do we understand what our cloud provider protects, what remains our responsibility and how the business would operate when one part of the arrangement is unavailable?
Cloud services are a strong foundation. They become dependable business systems when the responsibilities around access, data management and recovery are made equally clear.