What encryption controls protect data across cloud services and endpoints?

Encryption controls are the policies, technical settings and management processes that determine which data must be encrypted, how encryption keys are governed, and how the organisation verifies that protection remains in place across cloud services and endpoints. Effective control begins with identifying sensitive information and then applying requirements consistently to applications, storage, user devices, backups, removable media and administrative access.

A suitable control framework should define the following for each type of information:

• Data classification: establish which information is public, internal, confidential or highly restricted. Personal data, financial records, intellectual property, credentials and commercially sensitive documents will usually require stronger safeguards than information intended for public release.
• Encryption scope: specify which cloud services, workloads, databases, file stores, laptops, mobile devices and backup locations are in scope. A control that covers a primary system but not its exports, synchronised folders or backup copies leaves a significant gap.
• Approved methods: define acceptable cryptographic standards, minimum configuration requirements and rules for retiring weak or obsolete methods. The choice should reflect the sensitivity of the data, the service provider’s capabilities and the organisation’s legal or contractual obligations.
• Ownership: record who is responsible for enabling encryption, managing keys, reviewing settings and responding to failures. Responsibility may be divided between the cloud provider, the organisation, an IT administrator and an application owner.

Cloud encryption can be delivered in different ways. Provider-managed encryption may be enabled automatically by a cloud platform, reducing administrative effort but giving the provider greater control over the cryptographic lifecycle. Customer-managed keys provide more direct control over access, rotation and revocation, although they require stronger operational discipline. Some services also support application-level or client-side encryption, where information is protected before it reaches the service. This can reduce the provider’s ability to view the content, but it may affect search, sharing, recovery and integration features.

Key management is therefore as important as the encryption itself. Keys should be stored separately from the data they protect, with access restricted through named roles and strong authentication. Administrative permissions should follow least-privilege principles, so that a person who manages a cloud workload cannot automatically retrieve or use its encryption keys. Key creation, activation, suspension, replacement and destruction should be documented, with records retained for audit purposes.

Key rotation should be based on risk, service capability and policy rather than treated as a substitute for good access control. Rotation procedures must account for existing encrypted data, archived copies, replicas and applications that depend on the key. Before disabling or deleting a key, the organisation should confirm whether any live or retained information still requires it. Otherwise, a well-intended security action can make data permanently inaccessible.

Endpoint controls should address more than the operating system’s default settings. Full-device encryption helps protect data if a laptop or mobile device is lost, but it should be combined with secure boot, protected recovery information, managed screen locking and controls that prevent unauthorised changes. Organisations should also decide how encryption applies to removable drives, local virtual machines, offline files, cached cloud content and data copied into unmanaged applications.

Encryption does not remove the need to control access. An authenticated user or compromised account may still be able to read information through an approved application. Access policies, conditional access, identity monitoring, malware protection and data loss prevention therefore complement encryption. Where particularly sensitive data is involved, organisations may use application-level controls, restricted sharing, rights management or tokenisation to limit what an authorised user can do with the information.

Transport protection needs its own operational checks. Cloud services and endpoints should use current, properly configured secure communication protocols, with certificate validation and outdated protocol versions addressed through policy. Internal traffic between applications, management interfaces, backup systems and remote connections should be considered rather than assuming that information is safe simply because it remains within the organisation’s network.

Backups and recovery systems require specific attention. Encryption should cover backup repositories, replicated copies and export files, while recovery keys should be available to authorised recovery personnel without being exposed to everyday users. Recovery exercises should confirm that encrypted backups can be restored and that the necessary keys, permissions and documented procedures remain available. A backup that is technically encrypted but cannot be recovered is not an effective business control.

Monitoring should identify changes such as encryption being disabled, a key being used from an unusual location, a certificate approaching expiry, or an endpoint falling outside the required configuration. Logs should be protected from unauthorised alteration and reviewed according to the risk of the system. Periodic assessments should compare actual settings with policy, test recovery arrangements and examine cloud provider assurance information where the provider manages part of the control.

When selecting or reviewing a service, organisations should ask whether encryption is enabled by default, which data stores and backups it covers, who controls the keys, whether customer-managed keys are supported, how access is logged, and what happens when a subscription ends. Contracts and exit plans should address the return or deletion of data, retained backups and the treatment of customer-controlled keys.

For a small or medium-sized organisation, a practical implementation sequence is to classify important information, map where it is stored and copied, document the shared responsibilities of each cloud service, enforce endpoint encryption through device management, restrict key administration, test backup recovery and review exceptions. S2 Technology Group can help businesses around Stourbridge, Kinver, Wordsley, Kingswinford, Kidderminster, Halesowen, Dudley and neighbouring areas assess these controls as part of wider cloud and endpoint security planning.