7 Hybrid cloud storage compliance is where good intentions often break down. An organization decides that regulated data stays on premises and less sensitive data can use cloud services, then discovers during an audit that backups replicate to another region, logs flow to a foreign monitoring service, encryption keys are held by a provider and nobody can say exactly which buckets contain personal data. None of these problems is exotic. They come from gaps between environments that no single team owns. This article sets out seven practical compliance checks for hybrid cloud storage. Each check explains what to verify, why regulators and auditors care and what good looks like. Use it to review an existing hybrid estate or to design a new one. For the architecture behind these checks, see hybrid cloud storage for regulated industries. Check 1: Every data set is classified and mapped to an allowed location What to verify: there is an inventory of significant data sets, each with a classification (for example public, internal, confidential, regulated, sovereign), the rules that apply to it and the environments where it may be stored. Why it matters: regulators and data protection authorities expect organizations to know what data they hold and where. Classification is also the basis for every other control. What good looks like: A data register linking buckets, applications and owners to classifications. Placement rules per classification, by country where relevant. Tags or naming conventions on buckets that reflect classification. A review process when new data sets or applications appear. Check 2: Data, copies, metadata and logs stay where they should What to verify: primary data, replicas, backups, snapshots, metadata, logs and telemetry for each regulated data set are stored only in allowed locations. Why it matters: many compliance failures involve secondary data. A backup replicated to another region, or support bundles uploaded abroad, can breach data protection, sovereignty or sector rules even when primary data is correctly placed. What good looks like: Replication and tiering rules configured explicitly, not left at defaults. Cloud regions restricted by policy for regulated buckets. Monitoring and support tooling reviewed for data flows outside allowed locations. Periodic tests that trace where a sample data set and its copies actually reside. Check 3: Regulated records and backups are immutable What to verify: data that must not be altered or deleted, such as regulated archives, communications records, evidence and backups, is protected with compliance-mode object lock or equivalent controls in every environment where it is stored. Why it matters: rules such as SEC 17a-4 for broker-dealers and MiFID II recordkeeping expect records to be protected from alteration. Ransomware actors target backups first. An immutable copy on premises is undermined if the cloud copy can be deleted. What good looks like: Object lock in compliance mode for regulated records, with retention aligned to policy. Immutable backups in at least one environment isolated from production credentials. Legal hold processes that work across environments. Evidence that retention settings cannot be shortened by administrators. Check 4: Encryption keys are under your control What to verify: regulated data is encrypted at rest and in transit in every environment, and keys are managed by the organization rather than solely by a provider. Why it matters: whoever controls keys controls access. Sovereignty frameworks and many regulators expect organizations to retain control of keys for sensitive data, especially in cloud environments. What good looks like: Organization-managed keys or hardware security modules for regulated data. Key management located in allowed jurisdictions. Documented key rotation, recovery and revocation procedures. Separation between key administrators and storage administrators. Check 5: Access is least privilege and separated across environments What to verify: access to regulated data and storage administration is role-based, strongly authenticated and reviewed regularly, and credentials for one environment cannot be used to destroy data in another. Why it matters: compromised administrator accounts are the most common route to mass data loss. Regulators expect access reviews and separation of duties. What good looks like: Multi-factor authentication for all administrative access. Separate administrative identities for on-premises storage, cloud storage and backup systems. Quarterly access reviews with documented outcomes. Controlled, logged vendor support access. Check 6: Audit logs are complete, protected and centralized What to verify: data access, administrative actions and configuration changes are logged in every environment, protected from tampering, retained for the required period and fed into central security monitoring. Why it matters: auditors and investigators need to reconstruct who did what, where. Inconsistent logging between environments leaves blind spots. What good looks like: Storage-level access and admin logs enabled on premises and in cloud. Logs written to immutable storage and retained per policy. Central monitoring with alerts for unusual deletion or access patterns. Log retention aligned with regulatory requirements. Check 7: Recovery and exit are tested, not assumed What to verify: the organization can recover regulated data after site loss, provider outage or ransomware, and can move data out of any environment if needed, with tests to prove it. Why it matters: operational resilience rules, such as DORA for EU financial entities, require tested backup and recovery and exit strategies for critical ICT providers. Untested plans fail when needed. What good looks like: Documented recovery objectives per data class. Regular restore tests from each environment, including immutable copies. At least one full-scale recovery exercise per year for critical services. Documented and tested exit procedures using open interfaces such as S3. Using the checklist Run the seven checks as a structured review: Score each check as met, partially met or not met, with evidence. Prioritize gaps by risk: secondary data leaving allowed locations and mutable backups usually come first. Assign owners for each remediation, since hybrid gaps often fall between teams. Repeat the review at least annually and after major changes, such as a new cloud service or region. A worked example Consider a mid-sized European insurer running claims and policy systems on premises, with analytics and customer portals in public cloud. A review against the seven checks might find: Check 1: claims documents and call recordings are classified as regulated, but a new analytics data set built from them has no classification. Fix: classify derived data sets with their sources. Check 2: nightly backups of the policy database are replicated to a cloud region outside the EU by default. Fix: restrict replication to approved EU regions and document it. Check 3: on-premises archives use object lock, but cloud backup copies do not. Fix: enable compliance-mode object lock on the cloud backup bucket. Check 4: cloud data is encrypted with provider-managed keys. Fix: move regulated buckets to organization-managed keys. Check 5: the backup administrator account can delete both on-premises and cloud copies. Fix: separate identities and require approval for retention changes. Check 6: cloud storage access logs are not sent to central monitoring. Fix: integrate and retain them per policy. Check 7: restores have only been tested on premises. Fix: schedule a restore test from the cloud copy and document an exit procedure. None of these fixes is expensive, but together they turn a hybrid design that looked compliant on paper into one that holds up under audit. Regional notes The checks apply everywhere, but the details vary. EU organizations focus heavily on GDPR transfers, DORA and NIS2. Public bodies in France and Germany look to SecNumCloud and C5. UK organizations align with NCSC guidance and sector regulators. US organizations map checks to sector frameworks such as SEC, FINRA, HIPAA, CJIS or FedRAMP. Organizations in Japan and the UAE often add strict domestic data location for government and health data. Keep a per-country annex to the checklist for those specifics. Putting it together Hybrid cloud storage compliance comes down to seven questions: do you know what data you have, is every copy where it should be, are records and backups immutable, do you control the keys, is access tight and separated, are logs complete and central and have you tested recovery and exit? Answer them with evidence for every environment, close the gaps between teams and review regularly. That turns a hybrid estate into something you can defend confidently to auditors and regulators. Frequently asked questions What is hybrid cloud storage compliance? Ensuring that data stored across on-premises and cloud environments meets regulatory, data protection and security requirements wherever it resides. What is the most common hybrid compliance gap? Secondary data, such as backups, replicas, logs and telemetry, ending up outside allowed locations or without the same protection as primary data. Do cloud copies need immutability too? Yes. If regulated records or backups are copied to cloud, those copies should be protected as strongly as on-premises copies. Who should own hybrid storage compliance? A named owner for the overall framework, with clear responsibilities for each control across storage, security, cloud and compliance teams. How often should hybrid storage compliance be reviewed? At least annually and after major changes such as new cloud services, regions or regulations. Further reading Hybrid cloud storage for regulated industries Government object storage Data compliance framework Storage audit trail Hybrid cloud backup
