Most backup buying conversations start with features. The more expensive surprises tend to come from somewhere else: who owns the storage account, who can delete the copies, what it costs to read the data back out, and what happens to those copies when a contract ends.
Those questions sit in the storage layer, and they are easy to skip when a demo focuses on dashboards.
This checklist is for IT, finance and procurement teams evaluating Cloud Data Backup for business files. It assumes you have already decided you need backup. It focuses on where the copies live, who controls them and what recovery will really cost.
Separate the Storage from the Service
A cloud backup arrangement usually has two layers:
- The orchestration layer decides what gets copied, when, and how restores run. This is the backup software or service.
- The storage layer holds the copies. It might be the vendor’s own storage, a public cloud account you own, another SaaS storage service or on-premises hardware.
Some services bundle both layers. Others let you bring your own storage. Neither model is automatically better. What matters is that you know which layer you are buying and who is responsible for each one. Public cloud, private cloud, hybrid and cloud-to-cloud arrangements all get called “cloud backup,” yet they place control in very different hands.
Decide Who Controls The Copies
Ownership and access
Ask who holds the administrative credentials to the storage, and whether the backup vendor, your own team or both can read, change or delete the copies. If the vendor manages storage for you, ask how its staff access is controlled and logged.
Deletion and tampering
CISA’s #StopRansomware Guide notes that many ransomware variants try to find and delete or encrypt accessible backups. Among its cloud recommendations, it suggests enabling delete protection or object lock on storage that ransomware commonly targets, and turning on versioning so earlier variants of objects remain recoverable.
It also cautions that immutable storage should be used with care, because it may not meet some regulatory requirements and misconfiguration can be costly. Ask each provider how these controls work in their model and who configures them.
Separation From Production
If the backup copies sit inside the same account, under the same identity system, as the data they protect, a single compromised administrator could affect both. CISA suggests considering a multi-cloud approach for cloud-to-cloud backups so that a problem with accounts at one vendor does not reach every copy.
Check destination compatibility and location
Before shortlisting, confirm:
- Which source platforms each service can read from, and which destinations it can write to
- Whether your preferred storage region or on-premises location is supported
- Whether contracts, client agreements or internal policies set location or residency requirements
- How folder structure, versions and metadata are represented at the destination
Native platform backup options belong in this comparison too. Some keep copies inside the same provider’s environment, which suits certain organizations; others need a copy outside the primary platform.
The federal contingency planning guide NIST SP 800-34 (https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final) lists the criteria to weigh when choosing where backups are stored: geographic distance and the chance of being hit by the same disaster, how quickly data can be retrieved, security, and cost.
The point is to choose deliberately, not by default.
Put Recovery Costs on the Table Early
Storage pricing is rarely a single per-gigabyte figure. Published object-storage price lists commonly show that:
- Charges can include storage, requests, data retrieval and data transfer
- Some storage classes have minimum storage durations, so deleting or moving data early still incurs a charge
- Retrieving data from archival classes involves retrieval charges and, for some classes, a restore process
- Transfers out to the internet are billed beyond a monthly free allowance
Other providers structure prices differently, and rates change, so treat these as categories to ask about rather than numbers to budget with. Native backup add-ons publish their own pricing models, so compare like with like.
Cost questions for every provider
- What does the initial full copy cost, in service fees and in storage?
- What ongoing charges apply as data and versions grow?
- What does a large restore cost, including retrieval and data transfer?
- If you supply the storage, which charges appear on your cloud bill rather than the vendor’s invoice?
- Are there minimum terms or minimum storage durations?
Write the Responsibilities Down
A simple matrix prevents confusion during an incident. For each line, name an owner: you, the vendor or the storage provider.
| Responsibility | Owner to confirm |
|---|---|
| Storage account and credentials | |
| Encryption keys | |
| Retention and deletion settings | |
| Monitoring failed backup runs | |
| Performing and testing restores | |
| Storage and transfer bills | |
| Copies after contract termination |
Whether you consider a platform’s native backup, a general Cloud Backup Service from a cloud transfer specialist such as Cloudsfer, or another vendor, see which of these lines its documentation addresses and ask about the rest before you sign.
A hypothetical budgeting gap
Consider an illustrative professional-services firm that chooses a low monthly storage tier for its backup copies. The first test restore of a large folder adds retrieval and transfer charges nobody had included, and the restore takes longer than the team expected. The backup worked.
The procurement process simply never asked what recovery would cost.
The takeaway
Choosing a cloud data backup service is partly a storage decision. Before comparing features, confirm who owns and can delete the copies, where they will live, how the setup handles tampering and what a full restore will cost.
A completed responsibilities matrix and a priced test restore will tell you more about a provider than any feature grid.
