A common assumption among contractors is that moving to the cloud means backups are handled. Email lives in Microsoft 365, files sit in SharePoint and OneDrive, and drawings and RFIs live in a project platform. If the office server burns down, none of that is affected. That is true, and it is a real benefit. But availability of the platform is not the same as protection of your data.
Cloud providers generally operate under a shared responsibility model. They maintain the service. You are responsible for your content and for how it is accessed, changed and deleted. Understanding this difference helps you decide what to protect.
What can go wrong with cloud data
- Accidental deletion. An employee removes a project folder, or a bulk cleanup deletes more than intended.
- Malicious deletion. A departing employee or an attacker with a stolen account deletes or alters files.
- Ransomware via sync. Encrypted files on a laptop sync to the cloud and overwrite good versions.
- Account compromise. An attacker who takes over a mailbox can delete messages, create forwarding rules or exfiltrate content.
- Retention gaps. Native recycle bins and version history have time limits. You may discover the problem after the window has closed.
- Misconfiguration. Sharing settings or retention policies that do not match what you assumed.
Platforms offer built-in features such as recycle bins, version history and retention policies, which help with many of these. Review current documentation from your provider to understand their limits and what is included in your licenses.
What to include
Make a list of cloud data sources and decide how critical each is.
- Microsoft 365 mailboxes, including shared mailboxes.
- OneDrive for users and SharePoint sites for projects and departments.
- Teams files and chat, if used for business records.
- Project management platforms with RFIs, submittals, daily logs and photos.
- Cloud accounting or payroll systems.
- Identity configuration, such as groups, policies and conditional access settings.
For each, note where the data originates, who owns it and how long you need to keep it for contract, legal or warranty reasons. Construction records often must be available long after a project ends.
Options for protection
Third-party cloud backup
Several services back up Microsoft 365 and other software-as-a-service platforms into separate storage. Evaluate how often they back up, how long they retain data, how restores work, whether copies are immutable, and where the data is stored.
Export and archive
For project platforms without a backup service, periodic exports of critical records to protected storage can be practical. Closeout archives are especially valuable.
Retention and hold policies
Within Microsoft 365, retention policies and holds can preserve content for legal and business reasons. They are not a full backup substitute, but they reduce the risk of loss.
Configuration documentation
Record your tenant settings so you can rebuild policies quickly if needed.
Protect the accounts that control the data
Backup does not help if an attacker controls administrator accounts and can disable it. Use multi-factor authentication for all users, restrict administrator roles to named people with separate admin accounts, and monitor sign-ins and unusual forwarding rules.
Test your ability to restore
- Pick a sample mailbox and restore a deleted message from the backup.
- Restore a deleted SharePoint folder to a different location.
- Confirm timing and who is authorized to perform restores.
- Record the process.
Perform tests at least annually, and after major changes.
Questions for your providers
- What is retained, for how long, and can I extend it?
- Can an administrator permanently delete backups?
- How quickly can a full restore be completed?
- What happens to the data if I cancel service?
A starting point
If you only do three things: confirm retention settings in Microsoft 365, choose a backup method for mail and files that is separate from your admin accounts, and test a restore.
Ironfield Cyber helps contractors and energy companies protect cloud data, configure retention and test recovery. We can start with a short review of your current Microsoft 365 setup and highlight the gaps.