Cloud
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Microsoft's responsibility under the shared responsibility model is the availability of the service, not the recoverability of your content. Deleted items sit in a recycle bin for a retention window, and retention policies can hold mail for longer, but neither is a backup in the sense an auditor or an insurer means.
The gap shows up in three situations: a departing employee whose mailbox was removed with the licence, a ransomware event that synchronised through OneDrive, and a retention policy that quietly expired data somebody needed.
Ask whoever administers your tenant for three things: the name of the backup product, the date of the last successful job, and the date of the last restore that was actually performed. If the third question has no answer, that is the finding.
More
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
