The constant evolution of cyber threats requires CIOs, CISOs, and data controllers to adopt security postures that match the risks. When it comes to managing data at scale, technical, regulatory, and organizational requirements converge on one clear imperative: guaranteeing end-to-end control of the processing chain.

The CNIL's recent reminders reinforce this observation: the architecture of information systems handling massive volumes of personal data must rely on robust, scalable measures in line with the state of the art.

At Kiwi Backup, our role as a player in IT continuity and security leads us to support many organizations in this effort. Here is a strategic summary of the key recommendations, supplemented by good practices for critical environments.

1. Multi-factor authentication: a non-negotiable standard

In 80% of the major breaches observed in 2024, the initial vector was the exploitation of an account protected by a single password. This statistic alone shows that the lack of strong authentication is unacceptable technical debt, particularly in systems that are accessible remotely or interconnected with subcontractors.

Recommendation : deploy MFA based on a possession factor (physical token, OTP app, FIDO2 key), with logging of access attempts.

Note: compliance alone is not enough. It is the granularity of identity management and the consistency of access policies, based on systems such as IAM (Identity and Access Management), RBAC (Role-Based Access Control), or ABAC (Attribute-Based Access Control), that make it possible to finely restrict access rights to sensitive resources.


2. Flow-oriented security architecture: limiting structural exposure

Environments handling large volumes are inherently more attractive to attackers. Any extraction or export feature must therefore be audited with a view to minimal exposure.

This approach is part of a Zero Trust model, in which every flow is considered potentially hostile until it has been authenticated and authorized according to the established policies.

Critical areas to implement:

  • Detection of abnormal outgoing flows (Data Exfiltration Monitoring)
  • Volume limits per user, per API, or per time slot
  • Network isolation and application segmentation on sensitive perimeters

These approaches require active monitoring via a SIEM (Security Information and Event Management), a solution that centralizes, correlates, and analyzes security logs to detect incidents in real time, or at the very least a structured logging system, whose analysis must be automated on critical perimeters.

3. Logging: between regulatory traceability and active monitoring

Simply storing logs is not a security measure. Only contextualized, monitored, and analyzed logging can meet early detection requirements.

In particular, it helps identify attacks such as man-in-the-middle attacks, attempts to exploit backdoors, lateral movements associated with ransomware, or whaling campaigns targeting privileged workstations.


Good practices to apply:

  • Independent collection in a “log sink” outside production
  • Multi-level logging (network, application, databases)
  • Minimum retention of 6 months to 1 year depending on the perimeter
  • Prioritization of logs on critical assets (rather than blind generalization)

At a time when spyware and DDoS attacks are becoming widespread, the goal is clear: being able to quickly reconstruct the scenario of an incident and limit its consequences.


4. Organizational security: the human factor remains the primary vulnerability

Phishing, shared access, weak or reused passwords, handling errors: these vectors remain the favorite ground for initial compromises.


Recommended action: industrialize awareness campaigns (short, targeted, periodic formats), combined with attack simulation tools (phishing, credential leaks). Integrating frameworks such as SecNumAcadémie or SensCyber is a starting point, but it is not enough. The approach must be aligned with the maturity level of the teams.

5. Subcontracting governance: do not delegate responsibility

Outsourcing processing never transfers responsibility. CIOs must therefore continuously assess the security level of their service providers, beyond contractual clauses.

Minimum requirements:

  • Prior and periodic security audit
  • Systematic request for the subcontractor's information security policy (ISSP)
  • Precise clauses on sub-processors
  • Commitments on notification deadlines in the event of an incident

Particularly in cloud environments, transparency about the storage architecture, data location, and redundancy is imperative.


And if security fails? Backup takes over

Even the best-secured systems can be compromised. Faced with ransomware, insider threats, or critical errors, only a robust backup strategy can ensure resilience.

Kiwi Backup's positioning is part of this defense-in-depth approach, with solutions that guarantee:

  • Automated backups, end-to-end encrypted
  • Hosting in France, GDPR compliance
  • Centralized monitoring for MSPs, local authorities, and multi-site companies
  • Rapid deployment, including in hybrid or restricted environments

Backup is not optional. It is an essential component of your defense-in-depth strategy.


In conclusion

Current recommendations are no longer about minimum compliance. They outline a requirement for operational maturity in the face of systemic risk.

For IT professionals, this means:

  • Stronger access and isolation policies
  • The ability to monitor flows and behavior in real time
  • Investment in the security awareness of teams
  • And a high-availability, high-integrity backup strategy

Kiwi Backup supports CIOs and CISOs in securing their critical environments and making them resilient. Because losing data is no longer acceptable today