Cloud Backup for Business
Backing up to the cloud and backing up your cloud are different jobs. We check both, and how fast you could get data back.
A cloud copy you cannot download in time misses your RTO
Bandwidth, egress limits and restore paths decide how long a cloud restore really takes.
Your cloud provider keeps the platform running, not your data history
Most cloud services work on shared responsibility. Protecting your data and configuration is usually your part.
Two kinds of cloud backup
Backup to the cloud sends copies of on-premises servers and files to cloud storage, usually as the off-site copy. Backup of the cloud protects data that already lives in the cloud: Azure or AWS workloads, Microsoft 365 and other SaaS apps.
Cloud platforms offer strong building blocks such as Azure Backup immutable vaults and AWS Backup Vault Lock, but they have to be configured, separated from production credentials and tested.
Running workloads in Azure? See also the Azure cloud security audit.
What we check for cloud backup
| Area | What we look for |
|---|---|
| Scope | Every cloud workload and SaaS app holding business data is covered |
| Separation | Backups in a separate account, subscription or tenant from production |
| Immutability | Vault lock or object lock enabled with an adequate retention period |
| Region | Copies in a second region where an outage or residency rule requires it |
| Restore path | Bandwidth, egress and time to restore measured against the RTO |
| Cost control | Retention and storage tiers that do not silently delete what you need |
What we look for and why
Shared responsibility
Cloud providers protect their infrastructure. Your data, configuration and access remain your responsibility unless your contract says otherwise.
Egress and time
Pulling terabytes back from cloud storage can take a day or more. Large systems often need a local copy as well.
Account separation
If one stolen admin account can delete production and the backup vault, the cloud copy is not independent.
A finding from the sample report
- Area
- Backup architecture
- Finding
- Azure VM backups stored in the same subscription without vault immutability
- Severity
- Medium
- Evidence
- Recovery Services vault for 14 Azure VMs is in the production subscription. Soft delete is on, but vault immutability is not enabled, and four production admins hold Backup Contributor.
- Fix
- Enable and lock vault immutability, move backup administration to separate accounts, and consider a copy in a separate subscription or region for tier 1 VMs.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 6 of 16: Cloud backup for business
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business (this page)
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
Is cloud backup safer than local backup?
Neither is safe on its own. A local copy restores fast; a cloud copy survives site loss. Most businesses need both, with at least one immutable copy.
Does my cloud provider back up my data?
Platform redundancy is not the same as backup of your data history. Check your contract and the provider’s shared responsibility model, then protect what is yours.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Make sure your cloud copy is independent and restorable
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.