Who is responsible for securing a small business cloud environment?

Responsibility for cloud security is divided according to the cloud service being used, but the business remains accountable for how its cloud environment is configured and accessed. A provider may secure the physical data centre and core platform, while the organisation must make appropriate security decisions within its own account, applications and data.

The division of responsibility should be documented before a cloud service is adopted. It normally covers the following areas:

• Cloud provider: protection of the physical facilities, hardware, core networking and underlying platform is generally the provider’s responsibility. The exact boundary depends on whether the service is infrastructure, platform or software delivered through the cloud.
• Business: the organisation is responsible for selecting suitable settings, managing accounts, controlling access and deciding what information may be stored or processed in the service.
• Technology partners: an IT provider may configure, monitor and administer controls on the organisation’s behalf, but this does not remove the business’s accountability for its policies, risk decisions and legal obligations.

Identity and access management is one of the most important areas under the organisation’s control. Each user should have an individual account, with permissions limited to the systems and information needed for their role. Administrative accounts should be restricted, protected with multi-factor authentication and reviewed separately from ordinary user accounts. Former staff, temporary users and third-party accounts should be removed or disabled when access is no longer justified.

Cloud configuration also requires active management. Examples include storage permissions, network rules, application settings, encryption options, audit logging and the exposure of management interfaces to the public internet. A service can be technically secure at platform level while still being placed at risk by an incorrect tenant setting. Configuration changes should therefore be approved, recorded and checked after implementation.

The business must also protect the devices and connections used to reach cloud services. Security controls can be undermined by an unpatched laptop, stolen credentials, an unmanaged personal device or a compromised browser session. Relevant measures may include device updates, endpoint protection, screen-lock policies, secure remote access, staff awareness training and rules governing the use of business data on personal equipment.

Data protection is another business responsibility. The organisation should identify the information held in each service, apply suitable retention and sharing rules, and understand how data is deleted, exported and recovered. Backups should not be assumed simply because a service is cloud-based. The provider may replicate infrastructure for resilience, but that may not provide recoverable versions of accidentally deleted, corrupted or maliciously altered business data. Backup scope, retention, restoration and testing should be confirmed separately.

Security monitoring should produce useful evidence rather than simply collect technical events. The business should establish which activities need to be recorded, such as administrator changes, failed sign-ins, unusual access, permission changes and data exports. Someone must then review relevant alerts, investigate suspicious activity and retain records for an appropriate period. If monitoring is delegated, the agreement should state who receives alerts and who is responsible for investigating them.

Incident planning is shared in practice. The cloud provider should explain how it handles platform incidents and security events affecting its service. The business needs its own process for compromised accounts, inappropriate sharing, lost devices, malicious changes and suspected data breaches. That process should identify decision-makers, escalation routes, evidence requirements, communication responsibilities and the steps for containing and recovering from an incident.

Before signing up to a service, a small business should examine the provider’s security documentation and contract. Important points include:

• which security controls the provider operates and which the customer must configure;
• how security incidents are reported and what information is supplied;
• where data is processed and what subcontractors may be involved;
• how access by provider personnel is controlled and recorded;
• what backup, recovery and service restoration arrangements are included;
• how data can be exported if the service is changed or ended; and
• what audit reports, certifications or other assurance evidence is available.

These checks should be repeated when the service changes, new applications are connected, staff responsibilities alter or the organisation expands. A written cloud security register can help record owners, data types, integrations, privileged accounts, key settings and review dates.

S2 Technology Group can support a small business by assessing its cloud arrangements, clarifying control ownership and helping manage access, configuration, monitoring and wider cyber security measures. The objective is to turn the shared-responsibility model into clearly assigned tasks that can be reviewed and maintained as the organisation’s technology develops.