A backup that cannot be restored after a ransomware attack, accidental deletion or hardware failure is not a safety net. It is simply another copy of the problem. So, are cloud backups secure? They can be highly secure, often more secure than an unmanaged server or portable drive kept on site, but the answer depends on how the service is designed, configured and monitored.
For businesses and schools, the question is not whether data sits in a cloud data centre or a cupboard. It is whether unauthorised people can access it, whether criminals can alter or delete it, and whether your organisation can recover the right information quickly when normal systems are unavailable.
Are cloud backups secure for business data?
A reputable cloud backup platform protects data through several layers. Data is encrypted while travelling from your systems to the backup service and while stored in the provider’s data centres. Access should require strong authentication, and the platform should keep detailed records of administrative activity. Well-managed services also replicate backup data across separate infrastructure so that a single equipment fault or site incident does not remove every copy.
These controls address many weaknesses of traditional on-premises backup. A local backup appliance may be exposed to the same flood, fire, theft or power issue as the server it protects. It may also be missed by patching, run out of capacity or be left connected to a network during a ransomware incident. Off-site cloud storage creates useful separation.
However, cloud does not mean automatic protection. If an attacker gains privileged access to your Microsoft 365 tenant, backup console or administrator account, they may try to delete recovery points before encrypting live data. If backups have never been tested, a failed restore may only become apparent during a critical outage. Security comes from the service and the operating practices around it.
The controls that make cloud backup safer
Encryption is a starting point, not the entire answer. Data should be encrypted in transit and at rest using recognised standards. The more practical question is who manages the encryption keys and how access to those keys is controlled. Provider-managed keys are common and appropriate for many organisations, provided the provider has strong access controls. Customer-controlled key options can offer added control, but they also introduce responsibility: if keys are lost or poorly managed, data may become unrecoverable.
Multi-factor authentication is equally essential. Every account with access to the backup platform, especially administrative accounts, should use it. Role-based access is also valuable. A member of staff who only needs to check a job status should not have permission to change retention settings or erase all backups.
Protection against deletion is particularly relevant for ransomware resilience. Look for immutable backup storage, sometimes called write-once, read-many storage. For a defined retention period, immutable copies cannot be changed or deleted, even by an administrator with high-level access. This does not remove the need for careful account security, but it gives an organisation a recovery point that is far harder for an attacker to destroy.
A secure service also needs alerting and monitoring. Failed jobs, unusual deletion activity, storage capacity issues and changes to backup policies should be visible promptly. Silent failure is one of the most common backup risks. A daily report that nobody reads is not an effective control.
Cloud backup risks that still need managing
The largest vulnerability is often identity rather than storage. Weak passwords, shared administrator accounts, absent multi-factor authentication and excessive privileges can all expose cloud backups. The same principle applies to the systems being backed up: a backup platform cannot compensate for a compromised network if attackers can reach its management interface or steal administrator credentials.
Configuration is another concern. Backups can appear successful while excluding a key server, database, device folder or SharePoint site. Retention periods may be too short to recover a file that was corrupted weeks earlier. Equally, retaining every version indefinitely can increase cost and complicate data governance. The right retention policy depends on operational needs, contractual obligations and any legal or regulatory requirements.
Data location deserves a considered discussion, particularly for schools, organisations handling sensitive personal information and businesses with contractual obligations. Ask where data is stored, where it may be replicated, and what safeguards govern international transfers where relevant. UK GDPR compliance is not achieved merely because a supplier uses the word “cloud”. It requires suitable processing arrangements, security measures and accountability.
Availability is a separate issue from security. A provider may protect data well but have restore times that do not meet your recovery needs. Restoring a few documents is very different from rebuilding a file server, virtual machine estate or Microsoft 365 environment. Your agreed recovery time objective should reflect the operational impact of downtime, not a generic promise that data can be restored eventually.
Cloud backup is not the same as cloud storage
A common mistake is assuming that synchronised cloud storage provides a complete backup. Services such as OneDrive and SharePoint are excellent for collaboration, version history and day-to-day file access. They are not necessarily designed to meet every organisation’s retention, recovery and ransomware protection requirements.
For example, an employee might delete a folder, a synchronisation error might replicate unwanted changes, or a malicious actor might alter data across multiple locations. Native recycle bins and versioning can help, but they have limits. A separate Microsoft 365 backup provides an independent recovery route for Exchange Online mailboxes, OneDrive, SharePoint and Teams data, with retention designed around your needs.
The same distinction applies to virtual servers hosted in the cloud. Responsibility is shared. The cloud platform may protect the underlying data centre and physical infrastructure, while your organisation remains responsible for its data, configurations, access controls and backup strategy. Never assume a hosting provider’s resilience automatically covers your own recovery requirements.
What a sensible backup strategy looks like
The 3-2-1-1-0 approach remains a useful benchmark. Keep at least three copies of important data, stored on two different types of media, with one copy held off site. Add one immutable or offline copy, and aim for zero errors confirmed through regular recovery testing.
That does not mean every organisation needs a complicated set of separate products. It means avoiding a single point of failure. A small business may combine encrypted cloud backup with a local recovery device for faster restores. A school may need carefully defined retention, granular Microsoft 365 recovery and controls that support safeguarding and continuity planning. A business with critical line-of-business systems may require image-level backups and a documented disaster recovery environment.
The plan should identify which systems are essential, who can authorise a restore, how long recovery can reasonably take, and how staff will work if normal systems are unavailable. It should also cover devices used away from the office, because laptops may hold locally stored files that never reach a central server.
Questions to ask before choosing a cloud backup service
Before committing to a service, ask practical questions rather than relying on broad claims about security:
- Is data encrypted in transit and at rest, and how are encryption keys managed?
- Does every administrative account use multi-factor authentication and role-based access?
- Are immutable recovery points available, and for how long?
- Where is backup data stored, and what contractual arrangements support data protection obligations?
- What is included in the backup scope, and what is specifically excluded?
- How quickly can individual files, Microsoft 365 data, servers and full environments be restored?
- How are failed backups, suspicious activity and capacity problems reported?
- How often will restores be tested and documented?
Clear answers to these questions reveal whether a provider is offering meaningful continuity or simply selling storage space.
Security needs ongoing ownership
Cloud backups are most effective when they are part of a managed security and continuity process. Policies need reviewing as systems change. New SharePoint sites, new servers, mergers, software changes and staff departures can all affect what needs protecting and who can access it.
Herons IT helps organisations turn backup from a background task into a tested recovery capability, with security controls, monitoring and support aligned to their wider IT environment. The priority is not collecting another dashboard. It is ensuring that, when an incident occurs, the right data can be recovered by the right people within an acceptable timeframe.
Start with a restore test of one genuinely important system or dataset. It is a straightforward exercise, and the result will tell you far more about your real resilience than a green tick beside last night’s backup job.