How to choose cloud services for your SME: what to prioritise

Picking cloud services used to mean picking an email provider. For a typical SME it now covers email, documents, video meetings, the accounts package, the phone system and often the line-of-business application too. The choices are not hard individually, but made in the wrong order they produce a tangle that costs more than it should. This guide sets out the order that works and ends with a checklist you can take into supplier conversations.

Start with what the business needs, not with the provider

The most common mistake is comparing providers before the business has written down what it needs. Cloud platforms are flexible, and that flexibility only helps when it maps onto real work.

Begin by listing the systems that are genuinely business-critical: email and calendars, shared documents, the accounts package, customer records, the industry application and whatever the team uses to talk to each other. For each one, note who uses it, from where, and what happens if it is unavailable for a day.

Then look forward two years. A setup that works for ten users can struggle at thirty if licensing, permissions and folder structure were never planned. New sites, acquisitions and a shift to more remote working are all common in Hertfordshire and London businesses, and each one changes what "the right cloud service" means. With this list in hand, comparing cloud services becomes a matter of checking fit rather than being sold to.

Security and the shared responsibility model

Cloud providers secure their infrastructure. You remain responsible for your users, your data and your configuration. The NCSC's cloud security guidance describes this split clearly, and most SME cloud incidents happen on the customer's side of the line: a weak password without multi-factor authentication, a sharing link left open, or a leaver whose account was never disabled.

When judging a service, check how easy it makes the basics. Multi-factor authentication should be enforceable for every user, not optional. You should be able to control who can share externally and see an audit trail when they do. Conditional access, which restricts sign-in by device or location, should be available at a tier you can afford. Microsoft 365 Business Premium, for example, includes these controls, while lower tiers do not.

Finally, decide who will actually operate these settings. A service with excellent security features that nobody configures is no safer than one without them. That is a support question as much as a product question, and it is covered by a Microsoft 365 security review.

Compliance and where your data lives

UK GDPR does not insist that data stays in the UK, but the ICO expects you to know where it is processed and to have a lawful basis for any international transfer. Providers that store core data in UK or EU regions make this simple and reassure clients who ask.

Get the data location in writing and check that it covers backups, replicas and support staff access, not just primary storage. Law firms, accountants, healthcare providers and construction firms working under client frameworks often have contractual obligations on top of the law, so match the provider's documentation against those before you sign.

Cost transparency and what is not included

Cloud services are marketed on a simple per-user price, and that price is rarely the whole bill. Ask what is charged separately. Backup is the usual gap: Microsoft 365 provides recycle bins and retention windows rather than a restorable point-in-time copy, which is why a third-party Microsoft 365 backup is recommended and why our article on whether Microsoft 365 includes backup exists. Security add-ons, extra storage, hosted servers billed by the hour and premium support are the other common extras.

For the core suite, plan around Microsoft's published UK list prices or Google Workspace's published pricing, and match tiers to roles rather than buying the top plan for everyone. Then add the cost of managing it. Someone must add and remove users, review alerts, and keep licences tidy, whether that is a staff member's time or a managed service fee.

Reliability, support and how you would leave

Read the provider's service commitments, but pay more attention to how they communicate during an incident and how quickly you can reach a person. Generic vendor support rarely knows your business, which is why many SMEs pair a global platform with a local partner who handles onboarding, configuration and day-to-day queries.

Before signing, understand the exit. Can you export mailboxes, files and records in standard formats? How long does the provider keep your data after cancellation? Are you tied to a minimum term or a reseller you cannot switch away from? Building integration around one vendor's proprietary tools is fine if you intend to stay, and expensive if you do not.

A note for London and Hertfordshire businesses

Businesses in and around London face a particular mix of pressures: clients with demanding due diligence questionnaires, staff split between office, home and client sites, and high costs for every hour of downtime. Transport disruption and power problems in older buildings make cloud-hosted email and files a sensible resilience measure on their own.

Hertfordshire and west Essex businesses often have a different constraint, which is connectivity. A cloud-first design needs a dependable internet connection, and where full fibre has not yet arrived, a second connection or a hybrid setup with local storage is worth planning from the outset. Dig IT supports organisations across both areas from Hoddesdon, so the design usually takes account of the building as well as the software. See IT support in London and IT support in Hertfordshire for the local picture.

Cloud service selection checklist

Take this into every supplier conversation and do not sign until each line has a written answer.

• List of business-critical systems, users and locations completed before comparing providers
• Growth over the next two years considered, including sites and headcount
• Multi-factor authentication enforceable for every account
• External sharing controls and audit logging available at your chosen tier
• Conditional access or equivalent device and location controls available
• Data location for primary storage, backups and support access confirmed in writing
• Provider documentation matches any client or sector obligations you hold
• Full price understood, including backup, security add-ons, storage and support
• Third-party backup arranged for email, files and collaboration data
• Licence tiers matched to roles, with a process for removing leavers promptly
• Integration with the accounts package, CRM and industry application tested
• Incident communication and escalation route understood
• Export formats, data retention after cancellation and minimum term confirmed
• Named person or provider responsible for ongoing configuration and review

What to do next

If you are reviewing cloud services for a new office, a growing team or a provider that has stopped answering, work through the checklist first and bring the gaps to a conversation. Dig IT engineers help businesses across Hertfordshire, west Essex and London design cloud environments that are secure, properly backed up and simple to run. Talk to an engineer about your cloud options.