What should small businesses check before choosing a cloud service provider?

Choosing a cloud service provider means assessing whether its platform, operating model and contractual terms are suitable for the way your business works. A sound decision starts with documented business requirements, then tests each provider against technical compatibility, user administration, compliance, portability and the practical effort needed to adopt and manage the service.

1. Define what the service must do

Separate essential requirements from desirable features before speaking to providers. Record which applications need to move, who will use them, what devices they must work on and which business processes depend on them. Consider requirements such as multi-site access, mobile working, shared documents, application performance, reporting and connections to existing systems.

Also identify any systems that should remain on-premises or be hosted separately. A provider should be able to explain how its service fits into this wider environment rather than assuming every workload should be moved to the same platform.

2. Confirm the service model

Cloud services are not all managed in the same way. With software as a service, the provider normally manages the application and much of the underlying platform. Infrastructure services give the customer more control, but also leave more configuration and administration responsibilities with the customer or its IT partner. Platform services sit between these approaches.

Ask which parts of the environment the provider manages and which remain your responsibility. This should cover operating system maintenance, configuration, identity management, application updates, monitoring, user administration and incident investigation. A low-cost service may require more internal expertise than its headline description suggests.

3. Check administration and access controls

Examine how administrators and ordinary users are created, changed and removed. Useful capabilities may include role-based permissions, separate administrator accounts, approval workflows, audit records and integration with your existing directory service. Ask whether the provider can support different access levels for employees, contractors and external users.

Find out how access is handled when somebody changes role or leaves the organisation. The process should be clear, documented and capable of being managed without relying on one individual account.

4. Test compatibility with existing systems

Request technical documentation before committing. Check supported operating systems, browsers, devices, file formats, authentication methods and application programming interfaces. If the cloud service needs to exchange information with accounting, customer relationship management, manufacturing, logistics or document systems, establish whether that connection is native, configurable or dependent on bespoke development.

Ask for a demonstration using a realistic business process rather than a generic product tour. A small proof of concept can reveal problems with permissions, data formatting, printing, network traffic or user workflows before they affect a wider rollout.

5. Understand data ownership and portability

The contract should state that your organisation retains ownership of its data and explain how it can be retrieved in a usable format. Ask which export tools are available, whether metadata and permissions are included, and whether the provider will assist with transferring data to another platform.

Also check the process for closing an account. Important details include the notice period, export window, format of returned data, treatment of temporary copies and the point at which remaining data is deleted. These terms matter even if you expect to stay with the provider, because they reduce dependency on a service that may no longer suit the business.

6. Examine compliance and governance evidence

Ask for relevant policies, independent audit reports and information about the provider’s governance arrangements. The evidence should relate to the service you will actually use, not just to the provider’s wider organisation. Consider whether the service supports your obligations for record keeping, access reviews, retention and handling personal or commercially sensitive information.

Where your business operates across multiple locations or supplies regulated customers, document any customer, contractual or sector-specific requirements that affect cloud use. The provider should explain how its controls support those requirements, while recognising that compliance remains a shared responsibility.

7. Review implementation and change management

Ask how a new customer is assessed, configured and transitioned onto the service. A credible implementation plan should identify dependencies, migration stages, testing, user training, ownership of actions and criteria for approving the final setup. It should also explain how changes are requested, tested and recorded after implementation.

Clarify whether configuration work, data migration, user setup and documentation are included in the quoted service or treated as separate professional services. This distinction can materially affect the effort and total cost required to adopt the platform.

8. Look beyond the sales contact

Establish who will manage the relationship after the purchase. Ask how technical queries are logged, how issues are escalated, what information must be supplied when reporting a problem and whether you can access service documentation or a customer portal. It is also useful to understand how the provider communicates planned changes, product retirements and material alterations to its terms.

For a small business without a full in-house IT team, consider whether the provider’s responsibilities are sufficiently clear for your staff to manage. A managed IT services partner may also help coordinate the cloud platform with devices, connectivity, cyber security and existing business systems, but the exact division of work should be written down.

Before signing, compare providers using the same written requirements and ask for assumptions to be made explicit. The strongest option is not necessarily the one with the longest feature list; it is the one whose service model, responsibilities, technical fit and exit arrangements can be understood and managed by your organisation.