Cloud Security for Small Business

Moving email, files and business software to the cloud can make a small business more secure, but only if you handle your side of the arrangement. Large cloud providers secure their data centers, hardware and core platforms well. Most cloud incidents at small businesses come from the customer side: a stolen password with no second factor, a former employee who still has access, a file shared publicly by mistake, or an administrator account that was never protected.

This guide explains what you are responsible for, the settings that matter most, and how cloud use affects your insurance.

Understand the shared responsibility model

Every major cloud provider describes security as shared. The provider is responsible for the security of the cloud; you are responsible for security in the cloud. How the line falls depends on the service: you manage more with infrastructure services such as virtual servers and less with software services such as Microsoft 365 or Google Workspace. But some responsibilities never move. Microsoft lists four that always remain with the customer, whatever the service type:

The National Security Agency's Top Ten Cloud Security Mitigation Strategies, released in March 2024 with CISA as a partner on several of them, puts "uphold the cloud shared responsibility model" first on its list. Read your provider's documentation for the services you use and write down who handles each task, including tasks your IT provider performs for you.

Secure identities first

In the cloud, the sign-in is the perimeter. Most of your effort belongs here.

• Require multi-factor authentication for everyone, and stronger, phishing-resistant methods such as passkeys or security keys for administrators. See our multi-factor authentication guide.
• Separate admin accounts from daily accounts. Microsoft's guidance for small business admins is to use a standard account for email and daily work and sign in to an admin account only when needed.
• Use the least powerful role that does the job. Microsoft gives the example of assigning User Administrator rather than Global Administrator to someone who only creates accounts, and recommends limiting the number of admin accounts.
• Set up emergency access accounts. Microsoft recommends at least two emergency ("break glass") accounts so you are not locked out if normal admin sign-in fails, with alerts on any use. Our guide to privileged access management covers how to protect them.
• Remove access on the last day. CISA's performance goals call for disabling accounts and recovering badges and tokens by the day an employee departs. Review guest and contractor accounts too.

Configure the services securely

Default settings are designed for convenience. A few hours of configuration can close common gaps:

• Sharing. Limit or disable "anyone with the link" sharing, set expiration on external links and restrict sharing of sensitive folders.
• Email protections. Turn on the provider's anti-phishing and malware filtering, and publish SPF, DKIM and DMARC records for your domain. CISA's performance goals recommend these, with DMARC set to reject.
• Audit logging. Make sure sign-in and audit logs are turned on and kept long enough to investigate an incident.
• Third-party app consent. Limit users' ability to grant outside apps access to company mail and files without admin review.
• Use a baseline. CISA's Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for Microsoft 365 services such as Exchange Online, SharePoint, OneDrive and Teams. They were written for federal agencies, but they are public and make a useful checklist for your IT provider.

Protect and back up your data

Because data always remains your responsibility, decide how cloud data is classified, who can see it and how it is recovered. Our article on data classification offers a simple four-label scheme.

Do not assume the cloud provider's built-in retention is a backup. Version history and recycle bins help with an accidental deletion, but they are not designed for every scenario, such as an attacker or departing employee deliberately deleting data, ransomware syncing encrypted files, or an account being removed. Many businesses add a separate backup service for email, files and key cloud applications, with copies stored outside the primary account. See data backup strategies.

Two related habits prevent avoidable losses. Before deleting a departing employee's account or removing a license, confirm what happens to that person's mailbox and files under your provider's rules and transfer ownership of anything the business needs. And decide whether unmanaged personal devices may download confidential files at all; many business plans let you allow web access from personal devices while blocking downloads or sync, which keeps company data on company-controlled systems.

Watch the logs and the vendors

NSA's list closes with managing cloud logs for effective threat hunting. For a small business, that means someone, internal or a managed provider, reviews alerts for risky sign-ins, new forwarding rules on mailboxes, mass downloads and changes to admin roles. Mailbox forwarding rules in particular are a common sign of a compromised account used for business email compromise.

NSA also highlights the risk from managed service providers that hold administrative access to customer cloud environments. If an IT provider manages your tenant, ask how their technicians authenticate, whether access is limited to what they need, whether their actions are logged in your environment, and how quickly they would tell you about an incident on their side. Our vendor security assessment guide includes questions to ask.

Cloud use and your insurance

A cyber liability policy is the main policy for a breach or outage involving your cloud services. Points worth confirming with your broker:

• Definition of your computer system. Many policies include systems operated for you by a service provider, but definitions vary. Make sure data you store in cloud services is within scope.
• Dependent business interruption. If a cloud or software provider has an outage, your lost income falls under dependent or contingent business interruption coverage, if the policy includes it. Check whether it covers all providers or only named ones, whether non-malicious outages are included, and the sublimit and waiting period.
• Provider contracts. Cloud service agreements typically limit the provider's liability to you, often to fees paid. Plan on your own insurance, not the provider, to fund your recovery.
• Applications. Insurers commonly ask about MFA, admin account controls, email security and backups. Answer accurately and keep answers current.

Technology companies that host or manage data for clients have additional exposure and may need professional liability as well. See technology company insurance.

When to call your broker

Call us when you migrate email or files to a new platform, adopt a cloud system that runs a core part of your business, change IT providers, or prepare a cyber insurance application. As a broker, we compare cyber options across the market and shape coverage around the services your business depends on.

Sources

• Microsoft Learn — Shared responsibility in the cloud
• National Security Agency — NSA Releases Top Ten Cloud Security Mitigation Strategies
• Microsoft Learn — Admin account security in Microsoft 365 for business
• Microsoft Learn — Manage emergency access admin accounts
• CISA — Secure Cloud Business Applications (SCuBA) Project
• CISA — Cross-Sector Cybersecurity Performance Goals