Would you know where your data is stored, if a client asked?

Email is in Microsoft 365. Files are partly in OneDrive and partly on a server. The accounting system sits somewhere else. The website is with a hosting company. There is a backup, but it is not entirely clear where it is kept or who can reach it.

Everything works. But suddenly it turns out there is no single, orderly answer to a very basic question: where is the business's data, and who is responsible for it?

The questionnaire simply exposes what was already there

We meet these questions more and more at businesses that work with large companies, organizations and bodies that handle sensitive data. Before they let a supplier connect to their systems or hand over data, they want to know who they are working with.

Where is the data stored? Who can access it? How are permissions managed? Is there multi-factor authentication? Is there a backup, and when was it last checked by actually restoring from it? What happens when an employee leaves? And who handles a security incident if something goes wrong?

Amendment 13 to the Protection of Privacy Law, and the broader enforcement powers, sharpened organizations' accountability for privacy and information security even further - on top of information-security duties that already existed in the law. But even without a questionnaire and without regulation, these are things every business that relies on computer systems should know.

So where is the business's data, really?

In most businesses the answer is: in several places. And that is fine.

Email and documents may be in Microsoft 365, the ERP or accounting system runs on a server, the CRM is delivered as a cloud service, the website sits with a hosting provider and the backups are kept at another location. There is no obligation to consolidate everything in one place.

You do need to know what is where, what data moves between the systems, who is allowed to reach it and what happens when one of the systems stops working. The problem begins when that picture does not exist anywhere.

In most cases the problem is management, not location

You can keep a server in Israel and still manage it badly. You can use Microsoft 365 and build a secure, documented, well-managed workspace. The location of the data is part of the picture; it does not replace management.

An orderly IT environment should include least-privilege permissions, multi-factor authentication, security updates, monitoring, backups, restore tests and a clear process for closing access when an employee or supplier finishes their work.

You also need to know who holds admin permissions. This is something we run into often: a business has a software vendor, an IT company, a website manager, a marketing person and a few other parties that picked up permissions to various systems over the years. Some no longer work with the business, and no one always remembers they are still there.

When is public cloud the right answer?

For a business whose work is mainly email, Office, document sharing and meetings, a properly configured and managed Microsoft 365 can be an excellent solution. There is no reason to set up a private server just to be able to say you have one.

You can manage users and permissions, enable multi-factor authentication, control access to data, log actions and build a good workspace without owning a server. In such cases it is usually also simpler to operate.

And when does a private cloud server in Israel fit?

There are systems where a server is still the right answer. ERP systems, accounting software, databases, medical software, engineering systems and older business applications sometimes need a full Windows Server or Linux environment.

In other cases the business wants a dedicated, isolated environment where it can control the network, the compute resources, access, backup and the security policy. There are also organizations with a client requirement, a contractual commitment or a specific regulatory demand regarding the location of the data.

In those situations a private cloud server in Israel can be the right solution. But here too, the mere fact that the server sits in Israel is not enough. It has to be managed.

In many businesses the right answer is in between

This is actually one of the most common setups we manage. Microsoft 365 handles email, Office and document sharing. The main business system runs on a private server. Employees connect to it securely. The server is backed up to a separate system. The network is monitored. And access permissions are managed, instead of being left open for years.

There is no war here between "cloud" and "server". These are different tools that need to work together.

What about backup?

Here too it is important to know exactly what the word "backed up" means. A message that the backup completed successfully does not yet prove we can bring the business back to work on the day we need it.

You need to know what is backed up, how often, how long copies are kept, where they are and who can delete them. And every so often you also have to perform an actual restore, because the wrong time to discover a backup is broken is after the data is already gone.

Who holds the full picture?

This is one of the important jobs of an IT company that manages a business: not to wait for a fault before starting to find out where things are. You have to know the IT environment, document it, know which systems exist, who the vendors are, who holds permissions and where the backups are.

When this is done on an ongoing basis, an information-security questionnaire from a large client is no longer an investigation project. Most of the answers already exist.

We have been managing businesses' IT environments since 1996, on both public cloud services such as Microsoft 365 and private cloud infrastructure in Israel, building the environment around each business's systems and needs. The work is carried out within an information-security and privacy framework based on ISO 27001 and 27799, with a designated information-security officer and data-protection officer.