Your business runs in the cloud. Who is responsible for what, and the settings that matter most.

Who is responsible when your files are in the cloud?

A small design studio keeps its mail, its client files and its calendar in one cloud suite. Nobody there runs a server. That is a good trade. The provider’s engineers patch the software, guard the data centres and keep the service running.

It is only half of the trade. The provider does not decide who in your company can open the price list, or whether a freelancer who left in March still can. The UK’s National Cyber Security Centre, the NCSC, says a customer always keeps the job of setting a service up securely and of deciding what data goes into it. Microsoft’s own guidance puts data, settings, accounts and devices on the customer’s side, whatever kind of cloud service you use.

The provider locks the building. You hand out the keys.

Think of an office you rent in a shared building. The landlord looks after the roof, the lifts and the front door. You decide who gets a key to your office, and whether the door is shut when you leave. In the cloud the landlord is Google, Microsoft or Dropbox, and the keys are accounts.

Microsoft publishes its split as a table. For rented software such as its office apps, the physical servers, the network and the operating system sit with Microsoft. The application is shared, because Microsoft builds it and you configure it. Your data, your settings and your accounts sit with you in every column of that table. Devices are listed as shared, and the text under the table says that protecting them is still your job.

Other providers draw the line a little differently. The NCSC notes that the split depends on the kind of service and on how the provider built it, so read your provider’s own page before you assume.

Five settings that matter most.

All five sit in the right hand column, and you can check them in one afternoon. None needs a security team.

Two step login. A stolen password alone then no longer opens the account. The NCSC says any type of two step verification is better than none, and prefers passkeys where a service offers them, because they resist phishing. Start with the accounts that hold customer or staff data or would stop the business if you lost them: online storage, banking, payroll, your website and domain hosting. Your mail belongs on that list as well, since password resets arrive there.

Every sign in starts on a device.

Two step login protects the account. It does not protect the laptop the account is open on. Microsoft lists the laptops and phones that reach your cloud services among the responsibilities you always keep, and the NCSC gives device protection a page of its own in its guide for small organisations.

For a team on Macs, that is where Cybee works. It protects each Mac while programs run, hardens the Mac’s settings to the CIS Benchmark at the level you choose, and keeps a dated record of each, disk encryption and screen lock among them. It also lists the browser extensions and the AI tools installed on each Mac, which matters because an extension can read the pages of every cloud tool you open. When a client asks how the laptops that open their files are looked after, that record is the answer.

What clients and auditors ask about your cloud tools.

When a client’s security team reads your setup, the questions fall into two groups. The first is about the providers: is the tool itself audited by someone outside? The second is about you: how do you set the tool up, and how do you look after the people and devices that use it?

SOC 2 is a report that an outside accountant writes about how a service company runs its controls. According to the AICPA, the American body behind it, a SOC 2 report covers up to five areas: security, availability, processing integrity, confidentiality and privacy. Large providers often share theirs with customers who ask, usually through a trust or security page. A small agency rarely has one of its own. The article on SOC 2 for small agencies covers when a client really needs one.

ISO 27001 is an international standard for running information security as a management system, with written risks, named owners and regular reviews. ISO says it suits organisations of any size. A company can follow the standard on its own. It can also invite an outside audit body to examine it and issue a certificate, which ISO describes as one way to show clients that the company manages information safely. A certificate names the scope it covers, so a client will often want to see that the scope includes the product you use.

GDPR, the European data protection law, has applied since 25 May 2018. According to the European Data Protection Board, it covers organisations established in the EU or the wider European Economic Area, and organisations elsewhere that offer goods or services to people there. If a cloud tool holds personal data, such as client contacts or staff records, you decide why that data is used, and the provider handles it for you. Article 28 says you may use only providers that give sufficient guarantees, and that their work must be governed by a written contract. Article 32 asks you and the provider for security measures that fit the risk. Its own examples include encryption, the ability to restore access to data after an incident, and regular testing of the measures. That is the legal text behind the backup and the settings in the last chapter. This is general information, not legal advice.

None of these names makes a company safe by being said out loud. A client usually wants the provider’s report and your own answers about settings, devices and people. For the device part, Cybee’s Trust Passport is a dated record of how your Macs are protected. It does not cover your cloud accounts, and it is not an audit.

What to remember.

• The provider runs the servers and the software. Your data, settings, accounts and devices stay with you.
• Two step login, a separate admin account, reviewed sharing links, removed former staff and a tested backup are a good first pass on your side.
• A client asks for the provider’s report first, and for your own answers second.

Sources and further reading.

Written by Cybee for small teams. We read each page below on 28 October 2026. Providers and regulators change their guidance, so check yours before you rely on a detail.

• NCSC: Cloud security shared responsibility model
• NCSC: Small organisations guide to cyber security
• NCSC: Secure your important online accounts
• NCSC: Backing up your data
• Microsoft Learn: Shared responsibility in the cloud
• Google: Security checklist for small businesses
• AICPA: SOC suite of services
• ISO: ISO/IEC 27001
• European Union: General Data Protection Regulation, Articles 28 and 32
• EDPB: Data protection basics for small business