Most businesses store their most sensitive material in the cloud without ever stress-testing whether it's actually protected. Contracts, payroll records, customer data, product roadmaps — it all lives in a folder somewhere, and everyone assumes the provider "handles security."
They handle some of it. Not all of it.
Cloud security is a shared responsibility. Your provider secures the infrastructure; you're responsible for how it's configured, who can get into it, and what happens when things go wrong. That second half is where most companies quietly have gaps they've never noticed.
Here are the ten things worth actually checking — not just nodding along to.
1. Who can actually get into your files?
Start here, because it's the most overlooked. Pull up your permissions list right now and you'll probably find people with access they haven't needed in a year, or never needed at all. A salesperson doesn't need to see HR files. A contractor who left last spring shouldn't still have an active login.
The rule to apply is the principle of least privilege: give people access to exactly what their job requires, nothing more. Good cloud platforms let you slice this by user, team, role, or folder — so there's rarely a good excuse for over-permissioning everyone "just in case."
2. Is MFA actually turned on — not just available?
A password by itself is a fairly weak lock. If it leaks in a breach (and plenty do), that's the only thing standing between an attacker and your files.
Multi-factor authentication closes that gap by requiring something beyond the password — an app-generated code, a hardware key, a push notification. Most platforms support it. Far fewer businesses actually enforce it across every account, especially admin accounts, which are the ones that matter most.
3. Is your data encrypted — and do you know how?
There are two separate questions here, and they get conflated a lot:
In transit— is your data protected while it moves between a device and the server? This is usually handled by TLS/HTTPS, and it's table stakes at this point.
At rest— is data protected once it's sitting on a disk somewhere? This is where things get murkier. Ask your provider directly what encryption they use and who holds the keys. If you can't get a clear answer, that's itself an answer.
4. What actually happens when someone leaves?
Offboarding is where a lot of security policies quietly fall apart. An employee leaves, and their account lingers — active, forgotten, still connected to shared folders.
A real offboarding process covers more than deactivation. It means revoking active sessions, reassigning ownership of files they controlled, pulling them out of every shared space, and confirming nothing was missed. If this process lives in someone's head instead of on paper, it's not a process — it's a habit that will eventually get skipped.
5. Can you actually undo a mistake?
Someone will delete the wrong file. Someone will overwrite a document they meant to duplicate. It's not a matter of if.
The real question is whether you can recover from it — version history, a recycle bin with real retention, snapshots. But be careful not to confuse this with backup. Recovery tools built into your storage platform protect you from human error. They generally don't protect you if the whole platform goes down or gets compromised. Those are different problems.
6. Do you have a backup — or just a second copy in the same place?
This is the one businesses get wrong most often: they treat their cloud storage as the backup, when it's actually just... the storage. If that account gets compromised, misconfigured, or hit by ransomware, a "backup" that lives in the same account goes down with it.
The standard worth following is the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept off-site. And a backup you've never tested restoring from isn't something you can trust — it's a hope.
7. Do you know what's happening inside your own storage?
Locking the door is only half the job. You also want to know if someone's rattling the handle.
Activity logs — logins, failed login attempts, downloads, deletions, permission changes — are what let you catch something unusual before it becomes a real incident. Without them, you often don't find out something went wrong until a customer or a lawyer tells you.
8. What's your actual plan if ransomware hits?
Ransomware isn't a hypothetical anymore; it's a when-not-if line item for most businesses. The instinct is to focus entirely on prevention — MFA, least privilege, network security. All necessary. None of it guarantees you won't get hit.
The harder, less comfortable question is: if it happens anyway, how fast can you recover? That comes down to isolated backup copies an attacker can't reach, file versioning, and a recovery process you've actually rehearsed — not just written down and filed away.
9. Do you know where your data physically sits?
This one gets skipped because it feels abstract, until a compliance audit or a customer contract makes it very concrete. Where is your data stored — and where are the backups and replicas stored? Different regions come with different regulatory obligations, and "I'd have to check" isn't a great answer when a customer asks.
10. How much control do you actually have over the environment?
With public cloud, the provider owns most of the underlying infrastructure — you're working within their rules, their uptime, their roadmap. With private or self-hosted storage, you get more control over hardware, network, access policy, and data location.
More control isn't automatically more secure — a poorly managed private setup is worse than a well-managed public one. But it does mean you're not waiting on someone else's roadmap to fix something that matters to you specifically.
The checklist version, if you want to move fast
- MFA enforced on every account, especially admin
- Permissions reviewed on a real schedule, not "whenever we remember"
- Encryption confirmed in transit and at rest
- Backups that live outside your primary storage account
- A tested (not theoretical) recovery process
- Activity logs that someone actually looks at
- A documented offboarding checklist
- Clarity on where your data and backups physically live
If more than a couple of these are shaky, that's not a reason to panic — it's just a to-do list.
Public cloud vs. private cloud isn't the real question
People often frame this as a binary: public cloud is safe, private cloud is risky, or vice versa depending on who's selling what. Neither is automatically true. Public providers pour enormous resources into physical and infrastructure security. Private environments give you more control — and more responsibility that comes with it.
The better question isn't which one is "more secure" in the abstract. It's which one gives your business the right balance of control, visibility, and manageable responsibility.
Security isn't a purchase, it's a habit
Buying the right platform is step one, not the finish line. The businesses that actually stay secure are the ones that keep reviewing permissions, testing backups, watching activity logs, and training people — on a schedule, not just after something goes wrong.
Your contracts, financials, and customer data are worth more than a few hours a quarter to protect properly.
At LiteFiles, we help businesses take real control of their file storage and infrastructure — without giving up the convenience of working in the cloud.