Hey Doc The_Doc
Fair point here, and definitely worth exploring a little further.
ISO 27001 is, as you mentioned, risk-based — it doesn't mandate a specific architecture, so "no offline backup" can sit in a risk register as an accepted risk, if formally assessed with documented rationale and compensating controls.
But I think that strengthens the case against MYOB's actions here.
This isn't a pre-existing gap — it's a control that was withdrawn. Many chose MYOB because local backup existed and was built into the risk treatment plan. Removing it doesn't put MYOB on equal footing with a cloud-only competitor.
That platform also has third-party options — restorable backups via an independent provider — so the risk is mitigated outside the platform itself. MYOB removing local backup with no equivalent third-party path (that I have been able to find, at least) leaves us worse off than the example being used to defend it.
Mike_MYOB
I'd really like you to hear what I'm saying here. And I'd also like you to understand what's actually happening - your customers felt that the offline backup was a huge positive to using MYOB over the competition, and are extremely upset that it has been taken away. And the timing of this change, right before EOFY, was just a terrible, terrible choice on MYOB's behalf, warning or not.