Data held by others.
WHAT THE PROVIDER SECURES
Their infrastructure.
WHAT REMAINS YOURS
Your account security Who you grant access to What you put there Whether you have your own copy
THAT LAST POINT
A cloud service is not a backup unless you can restore from it independently.
WHAT TO DO
Strong unique credentials with a second factor Review who has access Review what is shared publicly Keep your own copy of anything critical
WHAT TO CHECK
Sharing settings. Files shared broadly and forgotten are common.
WHAT TO ASK OF A PROVIDER
Where data is held What happens if you stop paying How you export everything What their breach notification process is
THAT SECOND QUESTION
Establish how to get your data out before you need to.
WHAT TO REVIEW
Connected applications with access to your cloud accounts.
Revoke what is unused.
