Key takeaway
Start with inventory and ownership, then apply identity, encryption, backup and recovery controls according to data sensitivity.
Inventory data and owners
Locate confidential business, financial and customer records across cloud storage, SaaS apps and backups. Assign a business owner and technical steward to each data set, and record its approved purpose. If data is hard to find, review extra copies, abandoned projects and access rights too. Include service identities and broadly shared objects in the inventory.
Govern access through identity
Restrict viewing and changing sensitive data to roles and groups that match the job. Require MFA and individual accounts for people, and remove access after departure. Assign suitable scoped credentials to unattended workloads and review their permissions separately. Use an approved identity service instead of shared passwords, and review administrator and service-account permissions separately.
Encrypt data at rest and in transit
Check encryption for stored objects, disks and databases, as well as protection for data moving between devices and services. Learn who controls keys, when administrators can see plaintext and what responsibilities come with customer-managed keys. An encryption setting does not fix incorrect sharing permissions. Encrypted storage does not exclude authorized-service access to plaintext; a customer-managed key alone does not establish that exclusion either.
Backups and redundancy
Check backup coverage, retention and resilience to deletion or compromise of the production account. Separate its permissions from the live system, keep an independent copy of critical data and rehearse recovery. Geographic and service redundancy can improve availability, but accidental deletion or compromise can also affect copies. Agree acceptable data loss and recovery time with the data owner and measure them in a test. Restoring an encrypted backup also requires usable keys.
Review continuously
Cloud data changes as apps, staff and sharing rules change. Record access and configuration changes, alert on public or broadly shared objects and schedule owner reviews. Test processes for onboarding, role changes, project closure and account deletion.
Inventory the data
Select one sensitive dataset, locate copies and name its business owner; agree recovery criteria.
Review permissions
Review human, workload and sharing permissions separately; the owner approves removal of excessive access.
Restore an independent copy
The technical owner performs a test restore with usable keys and checks file readability, agreed data loss and recovery time.
Recheck changes
Repeat checks after role, app or sharing changes; assign a remediation owner to each gap.