How small businesses can ask better questions about access, backups, and recovery
Incident details below are as of November 2, 2026 and can change. Check the provider’s current advisory before acting.
When a cloud or IT provider has a security incident, customers usually have two immediate questions: Is our information safe, and can we keep working?
The answers depend on more than whether a provider has strong security tools. Customers also need to understand how outside services connect to their systems, who can access those connections, how backups are protected, and what happens when a service must be paused while an investigation is underway.
What to take away
- A provider incident does not automatically mean every customer was compromised.
- Customers may still need to review their own accounts and connected applications.
- Backups matter when the business can restore and use its data.
- Know who handles each security and recovery step before an incident happens.
A recent incident involving ConnectWise Cloud Backup offers a useful case for small businesses. ConnectWise reported unauthorized access to application credentials associated with the service. In its October 30 update, the company said restoration was progressing in phases. Backup and restore capabilities were available for reauthorized Microsoft 365 tenants, while other capabilities were still being restored. ConnectWise also said existing backup archives remained encrypted and isolated, with no indication of compromise. The company continued to advise partners to review their own and managed customer environments.
That status can change, so customers affected by the incident should follow ConnectWise’s current advisory and instructions. For other businesses, the broader lesson is to know how your provider’s security and recovery processes work before an incident happens.
A provider’s access can affect more than one business
Managed IT providers and cloud vendors often use applications, service accounts, or delegated permissions to support customers. These connections make administration and monitoring possible. They also create relationships that businesses should understand.
An incident involving one provider does not automatically mean every customer was compromised. It can mean that customers need to check their own cloud accounts, review changes made through connected applications, and follow specific reauthorization or recovery steps. A provider’s investigation may not reveal everything that happened inside each customer’s separate environment.
The Cybersecurity and Infrastructure Security Agency advises customers to account for supply chain risk when working with managed service providers. It also recommends spelling out responsibilities such as system hardening, detection, and incident response. Small businesses can use that guidance to make provider conversations more concrete.
Five questions worth asking your provider
-
1Which outside services can access our environment?
Ask which applications, service accounts, and vendors have permissions in your systems. Find out who approves those connections and how access is removed when it is no longer needed.
-
2How will we hear about an incident?
Ask who contacts you, how quickly you can expect an update, and what information you will receive. A useful incident update should explain what service is affected, what actions you need to take, and where to find verified instructions.
-
3Are backups separate from the systems they protect?
Ask where backups are stored, who can access them, and whether an issue affecting the backup service could also affect the original data. Ask how often backups run and whether recovery has been tested.
-
4How do we confirm a restore worked?
A backup job marked successful is only one part of recovery. Ask how the provider checks that restored files or applications are usable and how customers can request a recovery test.
-
5Who is responsible for each response step?
Write down who reviews security logs, disables suspicious access, contacts software vendors, and communicates with staff. CISA’s guidance for managed service provider customers recommends making these responsibilities clear in customer and provider arrangements.
Backups need a recovery plan
Backups matter most when a business can restore the information it needs within a useful timeframe. That takes planning: identify the applications and files that keep the business running, know who can authorize a restore, and make sure staff know how to work while systems are unavailable.
How CloudTop Office approaches hosting: CloudTop Office includes nightly backups and centralized encrypted storage in its hosting operations. We also provide secure access controls and support for the hosted accounting and business applications firms rely on, such as QuickBooks, Sage, Act!, and QuoteWerks. Those safeguards are part of the service, and recovery planning still works best when the provider and customer understand their roles.
Make the conversation part of choosing a provider
A cloud service can help a small business reduce the work of maintaining office servers and supporting remote access. Choosing a provider also means choosing how access, support, backups, and incident communication will be handled.
Ask for clear answers before you need them. Review the provider’s service commitments, confirm who owns each security task, and make sure you know where to find current incident updates. A short conversation now can make a difficult day easier to manage later. For a related checklist, see our 10 questions to ask a QuickBooks host before you sign.
Have questions about your hosted business applications?
Talk with CloudTop Office about secure access, backups, and support for the applications your team relies on.
Or call toll-free: (866) 710-4228
Frequently asked questions
Does a security incident at a provider mean my business was compromised?
Not automatically. The incident may require your business to review its own accounts, connected applications, permissions, and audit records. Follow verified guidance from the provider and your security adviser.
What should I ask about my backups?
Ask where they are stored, who can access them, how often they run, and how the provider confirms that restored data and applications are usable.
Who is responsible for responding to an incident?
The customer and provider should agree in advance who reviews logs, disables suspicious access, contacts vendors, restores systems, and communicates with employees.
Sources
- ConnectWise Trust Center advisory
- CISA guidance for managed service provider customers
- CISA risk considerations for MSP customers
Incident details reflect the cited ConnectWise advisory and can change. Check the provider’s current guidance before acting.
Leave a Reply