Why do multi-cloud backup and recovery environments create governance and access risks?

Why This Matters for Security Teams

Backup and recovery systems often hold the highest-value data in the environment, yet they are usually managed as operational infrastructure rather than privileged access surfaces. In multi-cloud setups, that creates a governance blind spot: restore consoles, service principals, snapshots, vaults, and cross-account permissions can move data in ways ordinary access reviews do not capture. The result is a recovery path that may bypass normal controls even when production IAM looks clean.

This is why NHI governance matters so much in resilience planning. NHI Management Group notes that The 2024 Non-Human Identity Security Report found 35.6% of organisations cite consistent access across hybrid and multi-cloud environments as their top NHI security challenge. That lines up with guidance in the NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10, both of which emphasize governance, least privilege, and continuous control of non-human access. In practice, many security teams encounter excessive restore privilege only after a backup account is used to exfiltrate data or overwrite recovery points.

How It Works in Practice

Multi-cloud backup environments create risk because each provider implements identity, encryption, logging, and restore workflows differently. A backup operator may need access to object storage in one cloud, snapshot APIs in another, and a separate SaaS console for catalog search or forensic restore. If those permissions are granted broadly, the backup plane becomes a transitive trust layer with far more reach than the production workload that originally generated the data.

Good governance starts by treating backup identities as privileged NHIs, not ordinary service accounts. That means separating read, copy, restore, delete, and key-management functions; assigning each function to a distinct workload identity; and enforcing short-lived credentials where possible. Policy should be evaluated at request time, not only when a role is created. The operational model is usually strongest when organisations pair cloud-native IAM with runtime checks from policy-as-code systems and align them to controls such as backup immutability, change approval, and break-glass review in NIST SP 800-53 Rev 5 Security and Privacy Controls.

Practitioners should also review the full lifecycle of non-human access. NHI Management Group’s Ultimate Guide to NHIs and Top 10 NHI Issues both reinforce that provisioning, rotation, revocation, and auditability must be consistent across providers, because backup tooling often accumulates long-lived secrets and exception paths that are easy to forget. These controls tend to break down when restoration is delegated to multiple ops teams across different cloud tenants because ownership and audit logging no longer line up cleanly.

Common Variations and Edge Cases

Tighter backup access often increases operational friction, requiring organisations to balance recoverability against the need for strict segregation of duties. That tradeoff becomes sharper during incident response, when teams want fast restore authority but also need to prevent an attacker from using the same path to destroy evidence or move laterally.

There is no universal standard for this yet, but current guidance suggests several practical exceptions deserve special treatment. Air-gapped or immutable backups still need identity governance because console access, vault admins, and API tokens remain attackable. Cross-region replication can also introduce hidden trust if one cloud account is allowed to seed another without explicit approval. If the environment uses third-party managed backup platforms, the shared responsibility model becomes even more complex because the operator may control metadata, orchestration, or encryption workflows even when data stays in your tenancy.

For that reason, security teams should explicitly define who can search backup catalogs, who can restore to a different account or subscription, and who can decrypt at rest. Those decisions should be logged, reviewed, and tested under realistic failure scenarios. The challenge is especially acute in large estates where organisations rely on multiple clouds, inherited admin groups, or emergency recovery accounts, because the backup plane can quietly become the easiest place to over-grant access.

Related resources from NHI Mgmt Group

• Why do hybrid and multi-cloud environments create more identity and governance risk for MSPs?
• Why do cloud password platforms still create concern for organisations with strict access governance?
• Why does standing access create governance problems for cloud and infrastructure teams?
• Who is accountable for API governance in hybrid and multi-cloud environments?