When several departments, locations and external partners work with the same documents, file management becomes a shared responsibility. Documents need to be available, access permissions must be appropriate, and changes must remain traceable.
Cloud solutions can support this collaboration. They provide storage, applications or infrastructure over a network and enable access beyond a single office location.
For larger enterprises and corporate groups, however, providing storage alone is not enough. A cloud solution needs to fit existing workflows, support central administration, and meet data protection and information security requirements.
Requirements Grow with the Organisation
Employee numbers alone reveal little about the cloud solution an enterprise needs. The number of locations, the types of data involved and collaboration with external parties also matter.
An international enterprise, for example, needs to manage access across different legal entities and project teams. A business handling confidential development documents needs clearly defined sharing permissions. Other organisations must retain documents for extended periods and make them available during audits.
Specific requirements are therefore more useful for planning than a classification based solely on company size:
- Which data and applications should be available through the cloud?
- Which employees and external partners need access?
- Which existing systems need to be integrated?
- What requirements apply to availability, recovery and retention?
These considerations help determine the necessary features and the responsibilities that remain with the enterprise.
Cloud Models Differ in Service and Deployment
Cloud offerings should be considered on two levels: the service provided and the deployment model.
Software as a Service (SaaS) provides ready-to-use applications, such as file-sharing or collaboration tools. Infrastructure as a Service (IaaS) supplies resources such as virtual servers and storage. Platform as a Service (PaaS) offers an environment for developing and running custom applications.
Responsibilities vary according to the service model. With a ready-to-use application, the provider typically handles more operational tasks than with rented infrastructure on which an enterprise runs its own software.
A private cloud is dedicated to a single organisation. In a public cloud, a provider offers services to multiple customers. A hybrid cloud connects different cloud infrastructures.
These terms do not automatically determine the level of security. A public cloud can be suitable for business data if the technical, contractual and legal requirements are met. A private cloud also needs secure configuration and reliable operation. Source: BSI — Cloud Computing Fundamentals
Collaboration Across Locations and Company Boundaries
A typical use case is making shared project documents available. Employees can access authorised documents even when they work at different locations or remotely.
A shared repository can reduce the number of separate file copies sent between participants. Synchronisation and version control help make current versions available and retrieve earlier ones. Whether several people can edit a document simultaneously depends on the application’s features.
Separate project areas can be set up for collaboration with customers, suppliers or service providers. External participants receive access to the documents they need, while internal documents remain in other areas.
Mobile working, file sharing and collaboration across locations are among the main use cases described on the existing TeamDrive enterprise page, in German.
Manage Access Permissions Centrally
Permissions change continually in larger organisations. Employees move between departments, take on new responsibilities or leave the company. External partners often need access only for a limited period.
A cloud solution should support these changes reliably. Groups and roles simplify administration because permissions do not have to be configured separately for every person. Access should reflect each person’s actual responsibilities.
Integration with existing identity management can help keep accounts and permissions consistent. Administrative accounts should have particularly restricted privileges.
Multi-factor authentication provides additional protection. Alongside a password, it requires another independent form of verification, such as an authenticator app or security key. A stolen password alone is therefore insufficient to sign in. Source: BSI — Two-Factor Authentication, in German
Consider Encryption and Key Management Together
Encryption protects content by making it unreadable without the appropriate key. When assessing a cloud service, enterprises should establish how data is encrypted in transit and at rest, and who can decrypt it.
End-to-end encryption protects content between the intended endpoints. Its effectiveness depends on the implementation, including key management and recovery.
This creates an organisational responsibility: authorised people must retain access to business-critical documents when employees leave or devices are lost.
A concept described as “zero knowledge” aims to prevent the provider from accessing unencrypted content. Any metadata that is still processed needs to be assessed separately. This may include account information or technical usage data.
Encryption also does not replace secure devices or careful sharing practices. Depending on the application, someone authorised to access a document may also be able to download or redistribute its contents.
Plan Data Backup and Recovery
Cloud storage can keep data physically separate from the enterprise’s own premises. This can help if local devices are lost through fire, water damage or theft. Reliable data protection nevertheless requires a defined backup strategy.
Synchronisation can propagate accidental deletions or damaged files to other devices. Enterprises therefore need to establish which previous states can be restored and how long they remain available.
They should also define how much data loss and downtime each process can tolerate. These decisions determine backup frequency and recovery requirements.
Backups must be protected against being affected by ransomware. The BSI recommends measures including keeping backup copies offline. Recovery procedures should be tested regularly. A backup alone also does not prevent the theft of confidential information. Source: BSI — Ransomware Measures, in German
Data Protection Depends on the Entire Processing Activity
Enterprises processing personal data in the cloud must consider the requirements of the GDPR. These include an appropriate legal basis, purpose limitation, suitable security measures, and rules for retention and deletion.
Where the provider acts as a data processor, the relationship must be governed in accordance with Article 28 of the GDPR. Additional processors and their services must also be considered.
Server location is a relevant selection criterion, but it does not answer every data protection question. Potential access, support services and transfers to third countries must also be assessed. The GDPR does not impose a blanket requirement to store all data exclusively in Europe; specific conditions apply to third-country transfers.
Even when a German data centre is used, the enterprise remains responsible for the lawfulness of its own processing activities. Source: GDPR, particularly Articles 5, 6, 28, 32 and 44 onwards
Archiving Is a Separate Requirement
Active project files, backup copies and records subject to retention requirements serve different purposes. Cloud storage should therefore not automatically be treated as an archive.
For electronic records relevant to taxation in Germany, the GoBD set out requirements including completeness, traceability and protection against undetected changes. Both the technology used and the procedures actually followed are decisive.
Enterprises need to determine which documents must be archived, which retention periods apply, and how the records will remain readable and available for examination throughout that period. Process documentation is also required. Suitable software supports these tasks; compliant use depends on the combination of the system and the organisation’s procedures. Source: German Federal Ministry of Finance — GoBD, in German
Compare Cloud Providers Against Operational Requirements
The price per user or per gigabyte is only one part of the comparison. For larger enterprises, administration, integration and long-term operation also matter.
| Selection criterion | What to assess |
|---|---|
| User management | Integration with existing identity services, roles and offboarding procedures |
| Integration | Interfaces, supported applications and required customisation |
| Security | Encryption, key management, logging and the scope of available assurance reports |
| Availability | Agreed service levels, support and incident procedures |
| Data backup | Backup coverage, retention periods and tested recovery |
| Costs | Licences, storage, additional features, migration and internal administration |
| Changing providers | Export formats, migration effort and deletion after the contract ends |
The scope of any certificate or audit report should always be checked. It is equally important to understand which measures the enterprise must implement itself.
Start Implementation with a Specific Process
A pilot project shows whether the solution works in everyday operations. A clearly defined document-sharing process between two locations or with an external partner is a suitable starting point.
Alongside technical functionality, usability, permissions and support should be assessed. The results then provide a basis for deciding how to bring in additional departments.
For ongoing operation, business departments and IT need clear responsibilities: who creates project areas, approves external access and reviews existing sharing permissions? These rules help keep cloud use reliable as user numbers grow.
For information about implementation with TeamDrive, visit our page on cloud solutions for large enterprises and corporate groups.
