Cloud Security and SaaS Safety for Small Businesses

The cloud is someone else’s computer, but your data

Most small businesses now use SaaS (software as a service): cloud email, online file storage, accounting software, a CRM or a shared spreadsheet. The provider runs the data centres, the hardware and much of the software. That is a big help. But the provider cannot decide who in your business should have access, which files should be shared, or whether a former contractor still needs to log in. Those decisions remain yours. This is called shared responsibility.

Shared responsibility in plain words

• The provider usually looks after: physical security of data centres, the underlying servers and network, and keeping the service running and patched.
• The business usually looks after: who has accounts, what roles they have, MFA, how files are shared, which third-party apps are connected, and what data is stored.
• Both sides matter for recovery: the provider may keep some history or a recycle bin, but limits and retention periods vary. Check what your plan actually includes.
• The exact split differs between services and plans. Read the provider’s own documentation rather than assuming.

Admin accounts deserve extra care

An admin account can create users, reset passwords, change security settings and sometimes export all data. If it is taken over, the attacker effectively owns your workspace. Keep the number of admins small but not one, so the business is never locked out. Use separate admin accounts for admin work where the service supports it, and do not use them for daily email and browsing. Every admin must have MFA, ideally with an authenticator app or security key. Make sure at least one admin is a business owner or trusted manager, not only an outside vendor.

A monthly cloud hygiene routine

1. 1Check that MFA is on for every user of critical services, starting with email and finance tools.
2. 2Review the admin list. Remove admin rights from anyone who no longer needs them.
3. 3Look for dormant accounts: people who have left, temporary staff and old contractors. Disable or remove them.
4. 4Review externally shared files and folders, especially ‘anyone with the link’ shares, and tighten or remove them.
5. 5Review connected apps and integrations. Remove those nobody recognises or uses, and revoke any keys or tokens that belonged to departed people.
6. 6Note what was reviewed and changed in a simple dated log, without recording any passwords or keys.

Offboarding: the most common gap

When an employee or contractor leaves, their cloud access must end on the same day. That means disabling their account, transferring ownership of their files, removing them from shared folders and groups, and checking whether they set up automations, forwarding rules or connected apps. Contractors and agencies are easy to forget because they were never added through HR. Keep one list of everyone with access to each critical service, including outsiders.