Is the Cloud Safe? Answering the Questions Your Board Will Ask
Every board has one. The member who reads a newspaper story about a data breach on Sunday and arrives on Thursday with questions. In our story his name is Mr Wekesa, he is a retired banker, and he is not wrong to ask. Cloud security for Kenyan businesses is a board-level issue now, and "the IT guy says it is fine" is not an answer that survives a second cup of tea. So here are the questions your board is likely to ask, with honest answers you can actually present.
"Is our data safer in the cloud or in the office?"
For most small and medium businesses, a reputable cloud provider will protect data better than an office server can. They have physical security, redundant power, dedicated security teams and constant monitoring. Your office server has a padlock and a guard who also opens the gate for deliveries.
The honest caveat: the cloud is only as safe as how you use it. Most breaches do not involve anyone breaking into a data centre. They involve weak passwords, phishing emails and staff accounts left active after people leave.
"Who is responsible if something goes wrong?"
Cloud security works on a shared responsibility model. The provider secures the infrastructure: buildings, hardware and the underlying platform. You secure what you put on it: who has access, how strong the passwords are, what settings are switched on and how your own staff behave. Board members should understand this split, because it determines where your effort and budget should go.
The cloud security questions about data and law
Expect questions about where data is stored and whether it is legal. Prepare answers to these:
Which countries our main systems store data in
How we meet our obligations under Kenya\'s Data Protection Act 2019
Whether we are registered with the ODPC where required
What our contracts with providers say about breaches and notification
Who internally is responsible for data protection
If you cannot answer some of these yet, say so, and present a plan to find out. Boards respect a clear gap with a date attached far more than a confident guess.
"What happens if the provider goes down, or goes bust?"
Fair question. Large providers do have outages, usually short ones. Your plan should cover what staff do if a key system is unavailable for a few hours, and how you would get your data out if you ever needed to leave a provider. Ask each vendor for their exit process and test an export of your data at least once. A provider that makes leaving difficult is telling you something.
"What are we doing about it?"
This is the question that matters most. Have a short, specific list ready:
Two-step verification enforced on all accounts
Access reviews every quarter, with leavers removed promptly
Regular backups that are tested, not just assumed
Basic security awareness training for staff, especially on phishing and M-Pesa fraud tricks
A written incident plan: who does what in the first hour if something goes wrong
None of these needs a huge budget. Most need someone to own them and a calendar reminder.
Bring a one-page summary
Boards love a single page. Summarise your main systems, where their data lives, the key controls in place and the top three risks you are working on. Update it each quarter. Mr Wekesa will read it twice, ask one sharp question and then, for the first time in months, move on to the next agenda item. That is a victory worth celebrating with a mandazi.
One last tip: if parts of your business run on custom systems, ask whoever built them the same board questions. Well-run custom software development should come with clear answers on hosting, backups and access, not a shrug and a promise to check.