Most cloud contracts get signed after a good demo and a reasonable quote. The questions that decide whether the move goes well tend to come up later: who is responsible when an account gets hacked, where the data actually lives, whether the provider will sign the agreement your regulator requires, and how you would get everything back out. If you are working out how to choose a cloud provider, ask those questions before you sign, while the answers can still shape the contract.
Key takeaways
- Before comparing providers, decide what you’re moving to the cloud and why. The right provider depends on what you’re moving.
- Whatever cloud service you use, you’re still responsible for your data, user accounts, who can access what, and your devices.
- Ask for proof from an outside auditor, such as a SOC 2 Type II report.
- Healthcare and financial firms need specific contract terms, such as a HIPAA business associate agreement.
- Ask about backups, past outages and what happens when you leave. Getting your data back out is part of the deal.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
Start with the workload
“The cloud” covers very different services, and a provider that is great for one may be a poor fit for another. List the systems you want to move, who uses them, what data they hold and what you hope to gain: remote access, less hardware, better resilience or easier growth.
- Software as a service (SaaS) is a finished application you sign in to, such as Microsoft 365 or a cloud practice management system.
- Platform as a service (PaaS) gives you managed databases and app hosting without managing servers.
- Infrastructure as a service (IaaS) is virtual servers and storage, often used to move an existing server application with few changes.
Most organizations with 10 to several hundred staff end up with a mix: Microsoft 365 for email and files, one or two specialty SaaS apps, and perhaps a hosted server for software that won’t run anywhere else. Map each system, including which ones depend on each other, before you shop.
Know which half of security stays with you
Signing up with a cloud provider moves some security work to them and leaves the rest with you. Microsoft’s documentation says the split shifts by service type, but some things stay with you whatever you buy.
- Your data, including how it is classified, protected and retained.
- The laptops, desktops and phones that connect to the service.
- User accounts, including adding and removing people.
- Access controls such as MFA, role-based permissions and conditional access.
With IaaS you also manage the operating system, applications and network controls. With SaaS the provider handles most of that. Either way, many cloud incidents at small organizations start on the customer’s side of the line: a reused password, an account nobody removed, or a setting left wide open. Our post on preventing cloud misconfiguration covers the common ones, and our cloud security best practices cover the rest.
How to choose a cloud provider: questions to ask
| Ask | What a good answer looks like |
|---|---|
| Can you share a current SOC 2 Type II report or ISO 27001 certificate for the service we would use? | A report covering that specific service, sent from a trust center or standard security packet |
| Is our data encrypted in transit and at rest, and who holds the keys? | A clear answer for both, in writing |
| Can we enforce MFA and single sign-on with our Microsoft 365 accounts? | Yes, configurable by your administrator |
| What logs can we see, how long are they kept, and can we export them? | Sign-in and activity logs you can export |
| How and how fast will you tell us about an incident affecting our data? | A defined notification process in the contract |
| Which subcontractors handle our data, and where? | A published list, with notice when it changes |
| What is your real outage history? | The uptime commitment in writing, plus actual history and a public status page |
| Which regions host our data, and is it copied to a second site? | Named regions and a description of redundancy |
| How long can deleted or overwritten data be recovered? | A recovery window that covers ransomware and a rogue admin |
| How do we get our data out if we leave? | Full export in a usable format, a stated retention period afterward, and a deletion process |
A provider that hesitates on these is telling you something. Ask for references from organizations your size, ideally in your field, and ask them about the worst outage they had and how the provider handled it.
48%
Share of breaches in Verizon’s 2026 Data Breach Investigations Report that involved a third party, up 60% from the year before
That is why it pays to vet a cloud provider the way you would vet any vendor with access to your data. Our post on securing your supply chain goes further.
Contract terms your industry may require
Healthcare and HIPAA
HHS says a cloud provider that creates, receives, maintains or transmits electronic protected health information for you is a business associate, even if it only stores encrypted data it can’t read. You need a signed business associate agreement before any patient data goes in. HHS also allows data stored overseas with a BAA in place, but expects you to weigh that location in your risk analysis. See how we support healthcare practices.
Accounting, tax and financial firms
The FTC Safeguards Rule requires covered firms to pick service providers that can maintain appropriate safeguards, put security expectations in the contract, monitor the provider’s work and reassess periodically. A cloud provider holding client tax or financial records falls squarely under that. File the security evidence you collect in your written information security program.
Law firms, nonprofits and everyone else
Client confidentiality duties, NDAs, donor privacy promises and state breach laws all follow your data into the cloud. Read the provider’s terms on data ownership, how it may use your data, and what happens to it when you cancel.
Plan the bill and the move
Cloud pricing swaps a large hardware purchase for an ongoing bill, which helps budgeting but can creep. Ask about storage growth, data transfer fees, minimum terms and which features need a higher tier. Then move in stages:
- Inventory systems and map dependencies.
- Set up security first: MFA, admin accounts, logging and backup.
- Pilot with a low-risk workload and a few users.
- Move the remaining workloads in phases, with a rollback plan for each.
- Review costs and access after 30 to 90 days and right-size.
As a Microsoft CSP partner, we set up Microsoft 365 for our clients, and on the security step our standard is phishing-resistant sign-in such as security keys or passkeys for admin accounts, and app approval with number matching for everyone else. We also keep separate backups outside the provider. Server backups run hourly, are copied off-site daily and are immutable. Microsoft 365 and Google Workspace data is backed up three times a day and is immutable too. All of it is stored in the US, so recovery never depends on a single vendor having a good day.
Bring your shortlist, or the contract you already signed, and book a 15-minute call. We will tell you plainly what should move and what should stay. Our hosted and cloud services and Microsoft 365 pages have more.
Frequently asked questions
What is a cloud service provider?
A cloud service provider runs software, platforms or servers that you use over the internet. The three main types are software as a service, such as Microsoft 365; platform as a service, such as managed databases and app hosting; and infrastructure as a service, which is virtual servers and storage. Your data, user accounts, access controls and devices stay your responsibility whichever you pick.
How do you choose a cloud service provider?
Start with the workload: list what you’re moving, who uses it and what data it holds. Then ask each provider for a current SOC 2 Type II report or ISO 27001 certificate, how data is encrypted, whether you can enforce MFA, how it reports incidents, its real outage history and how you get your data out if you leave. Healthcare practices also need a signed business associate agreement before any patient data goes in.
What business benefits do cloud computing services provide?
The usual gains are remote access, less hardware to buy and maintain, better resilience and easier growth. Cloud pricing also swaps a large hardware purchase for an ongoing bill, which helps budgeting but can creep with storage growth, transfer fees and higher tiers.
Sources
- Microsoft Learn: Shared responsibility in the cloud
- HHS: Guidance on HIPAA and cloud computing
- FTC: Safeguards Rule, what your business needs to know
- Verizon: 2026 Data Breach Investigations Report
- AICPA: SOC 2 reporting on controls relevant to security, availability, processing integrity, confidentiality or privacy
Next step
Let us handle this for you.
Roadmaps, budgets, migrations and contract reviews.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
