# Your business runs in the cloud. Who is responsible for what, and the settings that matter most. > You rent the software but the settings stay yours. Who looks after what in a cloud tool, five settings to check and what clients ask. Page: https://cybee.ai/blog/cloud-security-small-business/ (Cloud security for small business: who does what) - [Blog](https://cybee.ai/blog/) - Cloud security accounts Your mail, your files and your client chats sit on someone else’s servers. That hands part of the security work to the provider and leaves the rest with you. This guide shows which part is which, and the five settings worth checking first. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 10 minute read In one minute - When your mail, files and chats live in a tool you rent, the provider looks after the servers and the software underneath. - You look after your data, the settings, the accounts and the devices people sign in from. The NCSC and Microsoft both say so. - Five settings are a good first pass: two step login, an admin account you do not use daily, reviewed sharing links, former staff removed and a backup you have tried restoring. - A client or auditor asks about the provider’s own audit report, and then about how you set the tool up. - Cybee does not look at your cloud accounts. It protects the Mac people sign in from. ## Who is responsible when your files are in the cloud? A small design studio keeps its mail, its client files and its calendar in one cloud suite. Nobody there runs a server. That is a good trade. The provider’s engineers patch the software, guard the data centres and keep the service running. It is only half of the trade. The provider does not decide who in your company can open the price list, or whether a freelancer who left in March still can. The UK’s National Cyber Security Centre, the NCSC, says a customer always keeps the job of setting a service up securely and of deciding what data goes into it. Microsoft’s own guidance puts data, settings, accounts and devices on the customer’s side, whatever kind of cloud service you use. 50% of small businesses in the UK suffer a cyber incident every year, says the NCSC. Being small is no shield. Source: NCSC, Small organisations guide to cyber security **Q:** What does SaaS mean? ### What SaaS means. Software as a service: software you rent and open in a browser or an app, such as a mail suite, a file store or a team chat. The provider runs it. You use it and you set it up. Providers also rent out raw servers, where your share of the work is far bigger. This guide is about the rented software kind, which is what most small businesses use. ## The provider locks the building. You hand out the keys. Think of an office you rent in a shared building. The landlord looks after the roof, the lifts and the front door. You decide who gets a key to your office, and whether the door is shut when you leave. In the cloud the landlord is Google, Microsoft or Dropbox, and the keys are accounts. Microsoft publishes its split as a table. For rented software such as its office apps, the physical servers, the network and the operating system sit with Microsoft. The application is shared, because Microsoft builds it and you configure it. Your data, your settings and your accounts sit with you in every column of that table. Devices are listed as shared, and the text under the table says that protecting them is still your job. Other providers draw the line a little differently. The NCSC notes that the split depends on the kind of service and on how the provider built it, so read your provider’s own page before you assume. Figure: A rented mail suite, split the way Microsoft draws it for its own cloud apps. Other providers differ a little, so read yours. > The provider locks the building. Who holds a key is your decision. ## Five settings that matter most. All five sit in the right hand column, and you can check them in one afternoon. None needs a security team. Two step login. A stolen password alone then no longer opens the account. The NCSC says any type of two step verification is better than none, and prefers passkeys where a service offers them, because they resist phishing. Start with the accounts that hold customer or staff data or would stop the business if you lost them: online storage, banking, payroll, your website and domain hosting. Your mail belongs on that list as well, since password resets arrive there. **Q:** What is two step login? ### What two step login means. After your password, the service asks for a second proof that it is you, for example a code from an app on your phone, or a passkey stored on your device. It is also called multi factor authentication, or MFA. A passkey replaces the password with a secret that stays on your device, so there is nothing to type and nothing a fake page can collect. An admin account you do not use daily. The person who runs the workspace should sign in as admin only to change settings, and read mail with an ordinary account. Google’s checklist for small businesses says to use an account with limited admin roles for daily administrative tasks, and to enforce two step verification for admins and key users. It also suggests a second admin, so one lost phone does not lock everybody out. Sharing links. A link set to anyone who has it works for a forwarded email as well as for the client you meant. Google advises warning people before they share a file outside the company, and turning off link sharing as the default so new files start private. Every few months, look for files shared outside the company and close what nobody needs any more. Former staff. The NCSC points out that accounts of former staff, suppliers and contractors often stay open with old security settings. It advises removing or disabling any you no longer use and reviewing who can reach important accounts every few months. Say a developer who left in spring still belongs to the shared design drive in autumn. Nothing is wrong until the day it is. The [freelancer offboarding checklist](https://cybee.ai/blog/contractor-offboarding-checklist/) walks through the full list. A backup you have tried restoring. The NCSC’s advice is to copy the data the business needs to run, to keep a second copy apart from the first, to turn on two step verification for the online backup account, and to learn how to restore before you need it. Say you export the client drive to an external disk every month. Restore one folder from it today. If that fails, you have learned it on a quiet afternoon. Figure: Five checks for the tools you rent. Take them to your admin screens. ## Every sign in starts on a device. Two step login protects the account. It does not protect the laptop the account is open on. Microsoft lists the laptops and phones that reach your cloud services among the responsibilities you always keep, and the NCSC gives device protection a page of its own in its guide for small organisations. For a team on Macs, that is where Cybee works. It protects each Mac while programs run, hardens the Mac’s settings to the CIS Benchmark at the level you choose, and keeps a dated record of each, disk encryption and screen lock among them. It also lists the [browser extensions](https://cybee.ai/blog/browser-extension-permissions/) and the AI tools installed on each Mac, which matters because an extension can read the pages of every cloud tool you open. When a client asks how the laptops that open their files are looked after, that record is the answer. What Cybee does not do here It does not look at your cloud accounts, such as your mail suite, your file storage or your code host. It cannot tell you whether two step login is on, whether a sharing link is open or whether a backup works. Those checks stay with you and the admin pages of each tool. ## What clients and auditors ask about your cloud tools. When a client’s security team reads your setup, the questions fall into two groups. The first is about the providers: is the tool itself audited by someone outside? The second is about you: how do you set the tool up, and how do you look after the people and devices that use it? SOC 2 is a report that an outside accountant writes about how a service company runs its controls. According to the AICPA, the American body behind it, a SOC 2 report covers up to five areas: security, availability, processing integrity, confidentiality and privacy. Large providers often share theirs with customers who ask, usually through a trust or security page. A small agency rarely has one of its own. The article on [SOC 2 for small agencies](https://cybee.ai/blog/soc-2-small-agency/) covers when a client really needs one. ISO 27001 is an international standard for running information security as a management system, with written risks, named owners and regular reviews. ISO says it suits organisations of any size. A company can follow the standard on its own. It can also invite an outside audit body to examine it and issue a certificate, which ISO describes as one way to show clients that the company manages information safely. A certificate names the scope it covers, so a client will often want to see that the scope includes the product you use. GDPR, the European data protection law, has applied since 25 May 2018. According to the European Data Protection Board, it covers organisations established in the EU or the wider European Economic Area, and organisations elsewhere that offer goods or services to people there. If a cloud tool holds personal data, such as client contacts or staff records, you decide why that data is used, and the provider handles it for you. Article 28 says you may use only providers that give sufficient guarantees, and that their work must be governed by a written contract. Article 32 asks you and the provider for security measures that fit the risk. Its own examples include encryption, the ability to restore access to data after an incident, and regular testing of the measures. That is the legal text behind the backup and the settings in the last chapter. This is general information, not legal advice. None of these names makes a company safe by being said out loud. A client usually wants the provider’s report and your own answers about settings, devices and people. For the device part, Cybee’s Trust Passport is a dated record of how your Macs are protected. It does not cover your cloud accounts, and it is not an audit. ## What to remember. - The provider runs the servers and the software. Your data, settings, accounts and devices stay with you. - Two step login, a separate admin account, reviewed sharing links, removed former staff and a tested backup are a good first pass on your side. - A client asks for the provider’s report first, and for your own answers second. ## Sources and further reading. Written by Cybee for small teams. We read each page below on 28 October 2026. Providers and regulators change their guidance, so check yours before you rely on a detail. - [NCSC: Cloud security shared responsibility model](https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model) - [NCSC: Small organisations guide to cyber security](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security) - [NCSC: Secure your important online accounts](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts) - [NCSC: Backing up your data](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data) - [Microsoft Learn: Shared responsibility in the cloud](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility) - [Google: Security checklist for small businesses](https://knowledge.workspace.google.com/admin/security/security-checklist-for-small-businesses-1-100-users) - [AICPA: SOC suite of services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) - [ISO: ISO/IEC 27001](https://www.iso.org/standard/27001) - [European Union: General Data Protection Regulation, Articles 28 and 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [EDPB: Data protection basics for small business](https://www.edpb.europa.eu/sme-data-protection-guide/data-protection-basics_en) ## Plan for the day a person joins or leaves. Cybee shows the Mac and the AI tools of someone who joins or leaves, and keeps a dated record. [See team changes](https://cybee.ai/use-cases/team-changes/) On this page - Who is responsible - The provider and you - Five settings - The Mac you sign in from - What clients ask - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) Cybee Protects each Mac and lists its browser extensions and AI tools. Free for every Mac. [See how it works](https://cybee.ai/product/) ## Keep your side of the table tidy. Three more guides. [Accounts Which apps can read your company’s Google Drive? Review forgotten app permissions in your company’s Google admin console without stopping useful work. Read the guide](https://cybee.ai/blog/google-workspace-app-access/) [Mac security Can a browser extension read your client’s work? What extension permissions mean, how to review them and when to keep, limit or remove one. Read the guide](https://cybee.ai/blog/browser-extension-permissions/) [your team A freelancer leaves. What access do you remove? Accounts, shared files, AI connections, client keys and the handover record. Read the guide](https://cybee.ai/blog/contractor-offboarding-checklist/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)