A backup can look reassuring right up until the moment you need it. When a ransomware incident, deleted file or failed server puts business data at risk, the question is not simply whether a copy exists. It is whether that copy is protected, accessible and recoverable. So, are cloud backups encrypted? Usually, yes – but the practical answer depends on the provider, the service configuration and who controls access to the encryption keys.
For Irish businesses handling customer records, financial information, staff data and operational documents, encryption is a core part of a sound backup strategy. It should not, however, be mistaken for the whole strategy. An encrypted backup can still be deleted, overwritten, compromised through an administrator account or impossible to restore quickly enough for the business.
Are cloud backups encrypted? Usually, but verify how
Most established cloud backup platforms encrypt data while it travels from your systems to the backup platform and while it is stored. These are known as encryption in transit and encryption at rest.
Encryption in transit protects information as it moves across the internet, commonly using secure transport protocols. Encryption at rest protects data once it has reached the backup provider’s storage environment. If someone obtained the stored backup files without authorisation, the files should be unreadable without the correct key.
This is a strong starting point, but the phrase “encrypted backups” can conceal meaningful differences. One provider may encrypt data with keys it manages on your behalf. Another may offer customer-managed keys, where your organisation has more control over the key used to encrypt the data. A third may offer private or zero-knowledge encryption, where only the customer holds the decryption key.
More control is not always automatically better. If your business alone holds a private key and it is lost, the backup may be permanently unrecoverable. Provider-managed keys can reduce that operational risk, particularly for smaller organisations, but require confidence in the supplier’s security controls, access procedures and contractual commitments.
Encryption at rest is only one part of protection
A good backup service should make it clear which data is encrypted, which encryption standards are used, when encryption begins and how keys are stored. It should also explain whether encrypted data remains protected in temporary locations, replicated copies and long-term archives.
For example, a backup may be encrypted in cloud storage but briefly processed by a backup appliance or software agent before encryption is applied. That does not necessarily make the solution unsuitable, but it should be understood and secured appropriately. The same applies to restores: data needs protection when it is transferred back to your office, a new server or an employee’s device.
The backup type affects the answer
Not all cloud data protection works in the same way. A file synchronisation service may encrypt data in its own platform, but this does not mean it provides independent, point-in-time backup. If a member of staff deletes a folder and that deletion synchronises everywhere, a synchronised copy can repeat the problem rather than solve it.
Microsoft 365 is another common source of confusion. Microsoft protects its service infrastructure, but businesses should understand the distinction between platform resilience and a dedicated backup policy for Exchange Online, OneDrive, SharePoint and Teams. Your retention settings, recovery requirements and exposure to accidental deletion or malicious activity need to be considered separately.
On-premise servers, virtual machines, laptops and line-of-business applications also need different backup approaches. A cloud backup for a finance system may require application-aware backups to ensure databases restore in a consistent state. A simple copy of files is unlikely to be enough when the system must be operational again on Monday morning.
What encryption does not protect against
Encryption reduces the risk of unauthorised disclosure, but it does not make backups invulnerable. Ransomware operators increasingly target backup systems because they know organisations depend on them for recovery. If an attacker gains access to a backup administrator account, they may try to delete backup sets, shorten retention periods or encrypt the source data before it is backed up.
This is why a recovery plan should include immutable backup storage. Immutability prevents backup data from being altered or deleted for a defined period, even by a highly privileged account. It gives the business a safer recovery point when normal administrative controls have been compromised.
Access controls matter just as much. Multi-factor authentication should protect backup administration accounts, and those accounts should not be shared. Administrative permissions should be limited to people who need them, with activity logged and reviewed. Where possible, backup administration should be separated from everyday Microsoft 365 or network administration, so one compromised account cannot control everything.
There is also an availability question. Data can be perfectly encrypted but still unavailable if an account is suspended, a subscription lapses, an internet connection is down or restoration capacity has not been planned. Encryption protects confidentiality. Business continuity requires confidentiality, integrity and availability.
Questions to ask about encrypted cloud backups
Before approving a cloud backup service, ask for clear answers rather than relying on a broad security statement. The following questions help separate a basic storage offering from a recoverable business service:
- Is data encrypted both in transit and at rest, including replicated and archived copies?
- Who manages the encryption keys, and can we use customer-managed keys if required?
- Does the service support immutable backups or another control that prevents deletion and alteration?
- Is multi-factor authentication enforced for backup administrators, with role-based access controls?
- How long are backups retained, and can we recover a specific version from weeks or months ago?
- Where is the data stored and processed, and what contractual and data protection commitments apply?
- How quickly can critical systems, files and Microsoft 365 data be restored in a real incident?
The final question is often the most important. A provider may advertise strong encryption while offering only slow, manual recovery. For a busy office, a multi-site operation or a business dependent on specialist software, the recovery time objective must match the cost of downtime. Restoring a few documents is very different from rebuilding a server, a database and access for dozens of users.
Test recovery, not just the backup report
A green backup report confirms that a process completed. It does not prove that the selected data is usable, that the correct permissions will return, or that your team knows what to do during an outage.
Regular restore testing should be part of the service. This can include restoring individual files, mailboxes and folders, as well as testing larger recoveries for servers and critical applications. The test should check how long the recovery takes, whether data is complete and whether the restored system works as expected.
Businesses should also document priorities. If every system is labelled critical, recovery decisions become difficult during an incident. Identify the applications and information that must return first, the acceptable downtime for each and the people authorised to make recovery decisions. This gives an IT partner a clear operational plan rather than a vague instruction to restore everything.
Build protection around the business, not a single feature
The right cloud backup arrangement balances security, recoverability, cost and day-to-day management. A small business may benefit from a managed, provider-controlled service with clear retention, monitoring and support. A larger organisation with regulatory or contractual requirements may need customer-managed encryption keys, defined data location, longer retention and more detailed audit evidence.
LANCAST helps organisations assess backup and disaster recovery as part of the wider IT environment, including servers, endpoints, Microsoft 365, network access and cyber security controls. That wider view matters because backup security can be weakened by an unmanaged laptop, an overly powerful account or a missed alert just as easily as by poor storage settings.
The useful next step is to review one real recovery scenario: a compromised user account, an encrypted server or a deleted Microsoft 365 folder. If you can explain where the clean copy is, who can access it, how long restoration will take and what happens if the primary administrator is unavailable, your backups are doing more than storing data – they are supporting the continuity of your business.