Week 4 · Wednesday
Your provider’s security responsibilities and yours
Understand which security work a cloud provider handles, what your business still needs to manage, and how to confirm who does each job.
Imagine an employee leaves a small business, but their account still opens the company's cloud scheduling application.
The provider may be keeping its servers secure and its software updated. The business still needs a process that ends the former employee's access.
That example illustrates a useful idea: using a cloud service divides the security work between people and organizations. It helps to know exactly who is doing each part.
You do not need to become a security specialist to start. You need clear answers about important tasks, a named person to follow up, and a way to confirm the work happened.
What shared responsibility means
Shared responsibility means that the provider handles some security tasks while the customer handles others. The division depends on the service you buy and how it is used.
For a hosted business application, the provider generally operates and protects the underlying computers and systems. Your business makes decisions about its users, access, information, and the devices people use.
Microsoft's cloud guidance, for example, identifies customer duties around accounts, data, settings, and device protection even when using ready-made applications. Some functions are shared or supported by provider tools, so check the actual arrangement. Microsoft: Shared responsibility in the cloud.
A security feature being available is different from that feature being configured for your business. Ask who sets it up, checks it, and responds when something needs attention.
The kind of service changes the work
Last week, we introduced software as a service, or SaaS: a provider-operated application such as an online business tool.
Renting a cloud server gives you a different arrangement. Your business or IT provider may need to maintain the software installed on that server. AWS's example of its EC2 server service assigns customers duties including updates to the server's operating system, application software, and certain access settings. An operating system is the software that runs the computer. AWS: Shared Responsibility Model.
That distinction matters when someone offers to “put it in the cloud.” Ask what they will operate for you and what your team or another provider will still maintain.
You do not need the technical product category before you can ask, “Who applies the updates to each part of this service?”
Turn the discussion into named jobs
For an ordinary hosted business application, the following questions can help you clarify the arrangement. They are a starting point to confirm with your provider.
| Job | Question to settle |
|---|---|
| Protecting the service's underlying equipment | What does the cloud provider operate and maintain? |
| Adding and removing users | Who tells the account administrator that someone has joined, changed jobs, or left? |
| Choosing access permissions | Who approves what each person can view or change? |
| Protecting office and mobile devices | Who checks updates, screen locks, and other agreed protections? |
| Sharing business information | Who checks which folders or records can be accessed outside the business? |
| Recovering information | Who maintains recovery options, requests a restore, and confirms it worked? |
| Responding to a security concern | Who should staff contact, and who follows up with the provider? |
Avoid leaving a row assigned only to “IT.” If an outside company performs the task, record that company's role and the person in your business who can authorize or confirm the work.
For a two-person business in Jacksonville or Swansboro, the owner may fill several roles. The list can still be short and useful.
Keep changes in your team connected to changes in access
Return to the departing employee example. Someone has to know the employee is leaving, decide when access should end, and make sure the change reaches the relevant services.
Your arrangement might include an automated connection between account systems. It might depend on a request to an IT provider. Either way, confirm the process and who checks the result.
Also decide what happens to work the person managed. Files, appointments, and customer records may need an authorized new owner before an account is removed. Ending access and deleting business information are different actions.
This builds on Week 2's account ownership lesson. Give each person appropriate access through their own account where supported, and keep administrative access limited to the people who need it.
Multifactor authentication, or MFA, requires more than one kind of proof when signing in. Confirm who enables and checks the agreed sign-in protections for staff and administrators.
Include recovery in the conversation
A statement such as “we back everything up” needs enough detail to be useful.
Ask which information is covered, how often a recoverable copy is made, how long it is kept, and what happens if a file is deleted accidentally. Ask who can request a restore and whether recovering the information involves an extra charge.
Then ask to see a small recovery test using noncritical sample information. A description of the process and a demonstrated result answer different questions.
You may find that the application provides certain recovery features while a separate provider handles additional backups. Record the boundary so each party understands its job.
Confirm the agreement in writing
A short responsibility list can support a conversation, but it does not replace the service's terms or a written agreement about the work you are buying.
The FTC recommends putting vendor security expectations in writing and checking that vendors follow them. Its guidance also asks businesses to consider how vendors handle and retain information. FTC: Vendor security guidance.
Ask your provider to explain any unclear row in ordinary language. If a service or agreement changes, revisit the list. A plan that was accurate when you signed up may no longer describe the current setup.
A fifteen-minute exercise for your business
Choose one cloud application that holds important business information.
Create four rows: staff access, device protection, sharing settings, and recovery. For each row, write:
- The person or organization doing the work.
- The person in your business who confirms it.
- What evidence would show the task is complete.
- One question you still need answered.
For staff access, evidence might be an administrator confirming that a former employee can no longer sign in. For recovery, it might be a successful sample restore.
Mark unanswered rows as “not yet confirmed” and bring the list to your provider. Keep passwords and recovery codes out of this general reference document.
Your takeaway: Cloud security works better when each important job has a clear owner and a way to check the result. Confirm the division of work for the service you actually use.
On Friday, we will build a simple plan for a different kind of disruption: losing internet access or being unable to reach a cloud service.
Follow the Small Business Learning Series for new articles on Monday, Wednesday, and Friday at 1 p.m. Eastern.