How to Secure Sensitive Data in Cloud Environments: Essential Guide

How do you secure sensitive data in cloud environments when cyber threats evolve daily? With 68% of UK businesses now utilising cloud services, and cloud-based breaches costing an average of £3.2 million per incident, protecting your digital assets has never been more crucial.

Cloud security is no longer merely a technical consideration relegated to IT departments—it’s a fundamental business imperative that underpins trust, ensures continuity, and safeguards your most valuable assets. As organisations across the UK migrate critical operations and vast datasets to the cloud, the question is no longer whether to embrace cloud computing, but how to do so securely.

This comprehensive guide explores the essentials of keeping your data safe in cloud environments. We’ll examine foundational principles, practical implementation strategies, UK-specific regulatory requirements, and emerging security trends. By the end, you’ll understand how to implement robust cloud security measures that protect your organisation whilst enabling digital transformation.

Quick Answer: How to Secure Sensitive Data in Cloud Environments

Securing sensitive data in cloud environments requires implementing multiple layers of protection:

1. Encrypt all data: Use AES-256 encryption for data at rest and TLS 1.3 for data in transit.
2. Implement strong access controls: Deploy multi-factor authentication (MFA) and role-based access control (RBAC).
3. Choose compliant providers: Select cloud services certified for UK GDPR, ISO 27001, and Cyber Essentials.
4. Monitor continuously: Use Cloud Security Posture Management (CSPM) tools to detect misconfigurations.
5. Regular security audits: Conduct quarterly reviews of access permissions and security policies.

Below, we’ll explore each essential in detail, including UK-specific compliance requirements and implementation steps.

Understanding Cloud Security: More Than Just a Buzzword

The term “cloud security” appears in virtually every boardroom discussion about digital transformation. However, mastering its intricacies requires moving beyond buzzwords to understand its precise definition, undeniable importance, and the escalating threats it aims to counter.

What Exactly Is Cloud Security?

Cloud security refers to the strategies, processes, and technologies designed to protect data, applications, and infrastructure hosted in cloud computing environments. Unlike traditional on-premises security, which focuses on securing a defined network perimeter, cloud security must adapt to a more fluid, distributed, and often shared environment.

It’s not a single product or one-time implementation. Rather, it’s a continuous, multi-layered discipline built on shared responsibility and proactive defence. Effective cloud security encompasses data protection, identity and access management, network security, application security, and compliance governance.

Crucially, cloud security establishes proactive defence mechanisms. It anticipates potential vulnerabilities and threats, deploys preventative measures, and continuously monitors for anomalies. The dynamic nature of cloud environments demands constant vigilance and adaptation.

Why Cloud Security Is No Longer Optional for UK Businesses

For UK organisations, cloud security has transitioned from a ‘nice-to-have’ to an absolute necessity. Recent data from the National Cyber Security Centre (NCSC) consistently highlights the increasing sophistication and volume of cyberattacks targeting UK organisations, many of which leverage cloud vulnerabilities.

The escalating threat landscape means UK businesses face a relentless barrage of cyber threats, from ransomware and phishing to sophisticated state-sponsored attacks. Cloud environments, if not properly secured, present attractive targets for adversaries.

Strict regulations such as the UK GDPR and the Data Protection Act 2018 impose significant responsibilities on organisations handling personal data. Non-compliance, especially due to cloud security lapses, can result in fines of up to £17.5 million or 4% of global turnover, whichever is higher.

A single cloud breach can erode years of built-up customer trust. According to recent surveys, 83% of UK consumers consider data security when choosing service providers. News of data compromise spreads rapidly, impacting brand image, customer loyalty, and ultimately, your bottom line.

Strong cloud security fosters innovation. It allows businesses to confidently experiment with new cloud services, develop cutting-edge applications, and scale operations rapidly, knowing their foundations are secure.

The Evolving Threat Landscape: What You’re Up Against

Cloud computing introduces unique attack vectors and amplifies existing ones. Understanding these specific threats is the first step in building an effective defence.

1. Cloud misconfigurations represent the leading cause of cloud breaches. According to the ICO’s 2024 annual report, cloud misconfigurations were responsible for 34% of reported UK data breaches. Simple errors in configuring storage buckets or security groups can expose sensitive data to the public.
2. Weak or compromised credentials, insufficient multi-factor authentication, or overly permissive access roles grant attackers unfettered access to cloud resources. This often stems from phishing attacks or insider threats.
3. Insecure APIs can be exploited to access, modify, or delete data. The OWASP API Security Top 10 highlights that API vulnerabilities were responsible for major UK data breaches in 2024.
4. Data loss includes accidental deletion, ransomware attacks, or data exfiltration. The interconnected nature of cloud environments means vulnerabilities in one area can cascade across your entire infrastructure.

What Security Feature Adds an Extra Layer of Protection to Cloud-Based Systems?

Multi-factor authentication (MFA) is a security feature that adds a significant extra layer of protection to cloud-based systems. MFA requires users to verify their identity using two or more authentication factors before accessing cloud resources, creating a robust barrier against unauthorised access.

How MFA Protects Cloud Systems

MFA combines something you know (a password), something you have (a mobile device or security token), and something you are (biometric data). Even if a password is compromised, unauthorised access is prevented.

According to Microsoft research, MFA blocks 99.9% of automated cyberattacks. For UK businesses handling sensitive data, implementing MFA is increasingly a regulatory requirement under UK GDPR and recommended by the National Cyber Security Centre.

Types of MFA for Cloud Security

1. SMS-based verification sends one-time codes to registered mobile numbers. However, the NCSC warns that SMS verification is vulnerable to SIM-swapping attacks.
2. Authenticator apps generate time-based codes using applications like Microsoft Authenticator or Google Authenticator. These provide stronger security than SMS-based methods.
3. Hardware tokens, such as the YubiKey, are physical devices that provide the highest security level for high-risk environments, particularly for administrative accounts.
4. Biometric authentication uses fingerprint or facial recognition for seamless access while maintaining strong security.
5. UK organisations should prioritise authenticator apps or hardware tokens over SMS-based MFA, particularly for accounts accessing sensitive data or administrative functions.

The Foundational Pillars of Robust Cloud Security

Effective cloud security requires implementing multiple overlapping controls that work together to protect your data. The following solutions form the foundation of a comprehensive cloud security strategy, each addressing specific vulnerabilities whilst reinforcing overall protection.

Encryption: Your First Line of Defence

Data encryption is the fundamental practice for securing sensitive information in cloud environments. Encryption transforms readable data into complex code that remains unintelligible to unauthorised users, protecting information even if intercepted during transmission or accessed in storage.

Types of Cloud Data Encryption

Encryption at rest protects data stored in cloud databases, file systems, and backups. Leading UK cloud providers use AES-256 encryption as standard, which would take billions of years to crack with current technology.

Encryption in transit secures data as it moves between your systems and the cloud, using Transport Layer Security (TLS 1.3). This prevents man-in-the-middle attacks during data transfer, ensuring information remains confidential even when travelling across public networks.

End-to-end encryption ensures only the data owner can decrypt information—not even the cloud provider can access it. This is essential for highly sensitive data under UK data protection regulations, particularly in healthcare, legal, and financial sectors.

UK-Specific Encryption Requirements

Under the UK GDPR and Data Protection Act 2018, encryption is considered an essential security measure for personal data. The Information Commissioner’s Office specifically recommends encryption for personal data stored in cloud environments, data transferred to third-party processors, backup and disaster recovery systems, and mobile devices accessing cloud services.

Organisations must use encryption that meets current industry standards. The NCSC recommends AES-256 for symmetric encryption and RSA-2048 or stronger for asymmetric encryption.

Implementing Cloud Encryption

1. Enable encryption by default on all cloud storage services. Most modern cloud platforms offer this as a standard configuration option.
2. Use customer-managed encryption keys for sensitive data, giving you complete control rather than relying solely on provider-managed keys.
3. Implement key rotation policies with a minimum quarterly schedule. Regular rotation limits the potential impact of compromised keys.
4. Document encryption methods for compliance audits. UK regulators expect organisations to demonstrate their encryption practices.
5. Test decryption procedures in disaster recovery plans to ensure business continuity.

Access Control and Identity Management

Identity and Access Management (IAM) controls who can access your cloud resources and what they can do with them. According to the 2024 Cloud Security Report, 68% of cloud security breaches stem from compromised credentials or inadequate access controls.

The principle of least privilege ensures users only access resources necessary for their job functions, minimising potential damage from compromised accounts.

1. Role-based access control (RBAC) assigns permissions based on job roles, simplifying management whilst maintaining security.
2. Privileged access management (PAM) provides additional security layers for administrative accounts, including mandatory MFA and just-in-time access provisioning.
3. Regular access reviews should occur at a minimum of quarterly to identify and remove unnecessary permissions.

Data Loss Prevention

Data Loss Prevention (DLP) solutions monitor and control data movement across your cloud environment. DLP prevents sensitive information from leaving your organisation through unauthorised channels, whether through malicious intent or accidental disclosure.

Modern DLP systems identify sensitive data using content inspection, contextual analysis, and pattern matching. They can recognise UK-specific identifiers such as National Insurance numbers, NHS numbers, and UK passport numbers.

DLP policies can block, quarantine, or encrypt sensitive data based on predefined rules. For example, policies might prevent credit card numbers from being uploaded to personal cloud storage or automatically encrypt emails containing legal documents.

The ICO considers DLP an important technical measure for demonstrating UK GDPR compliance, particularly for organisations processing large volumes of personal data.

Intrusion Detection and Prevention

1. Intrusion detection systems actively scan network traffic for signs of potential threats or breaches. These systems provide real-time alerts and notifications, enabling rapid response to suspicious activities before significant damage occurs.
2. Cloud-based intrusion prevention systems can automatically block detected threats, providing immediate protection while security teams investigate. This automated response is crucial given the rapid escalation of cloud-based attacks.
3. Security Information and Event Management (SIEM) platforms aggregate security data from across your cloud environment, providing centralised visibility and advanced threat detection through correlation and analysis.
4. Modern cloud security platforms use machine learning to identify anomalous behaviour that might indicate compromised accounts or insider threats, detecting patterns that traditional rule-based systems might miss.

Disaster Recovery and Business Continuity Planning

1. Disaster recovery planning ensures your organisation can restore operations following a security incident, natural disaster, or system failure. Cloud environments offer unique advantages, including geographic distribution and rapid provisioning.
2. Recovery Time Objective (RTO) defines the time required to restore systems. Recovery Point Objective (RPO) determines the acceptable amount of data loss. These metrics guide your disaster recovery architecture.
3. Implement automated backup systems with multiple retention points. The 3-2-1 backup rule recommends storing three copies of data on two different media types, with one copy kept offsite.
4. Regular testing of disaster recovery procedures is essential. Quarterly or bi-annual tests identify gaps and ensure staff understand their roles during recovery operations.
5. UK organisations subject to the Network and Information Systems (NIS) Regulations are required to maintain documented business continuity plans.

Most Important Aspects of Cloud Security

When securing cloud environments, certain aspects take priority based on their impact on data protection and compliance. Understanding which elements matter most helps organisations allocate resources effectively and build security programmes that deliver maximum protection.

1. Identity and Access Management (IAM)

The most important aspect of cloud security is controlling who has access to your data and resources. A single compromised account with excessive permissions can expose your entire cloud environment.

The ICO requires organisations to demonstrate appropriate access controls as part of UK GDPR accountability obligations. Inadequate access controls frequently feature as primary contributing factors during breach investigations.

Implementing strong IAM includes deploying MFA universally, applying least privilege principles, conducting regular access reviews, implementing privileged access management, and maintaining comprehensive audit logs.

2. Data Encryption and Protection

Protecting data confidentiality through encryption is the second most vital aspect. Even if attackers breach your perimeter, encrypted data remains protected without the need for decryption keys.

Under UK data protection law, unencrypted data breaches must be reported to the ICO within 72 hours. Proper encryption can reduce or eliminate notification requirements if data is rendered unintelligible.

Encryption also protects competitive advantage by securing intellectual property and proprietary information from industrial espionage.

3. Continuous Monitoring and Threat Detection

Real-time visibility into your cloud environment enables rapid detection and response to threats. Cloud environments change rapidly—what’s secure today may become vulnerable tomorrow through misconfigurations or new attack methods.

Cloud Security Posture Management (CSPM) tools continuously assess your cloud configuration against security best practices, identifying misconfigurations and security gaps as they emerge.

The average time to identify a breach in cloud environments is 207 days. Continuous monitoring dramatically reduces this detection time, limiting the scope and cost of security incidents.

4. Compliance and Governance

Understanding and maintaining compliance with UK regulations ensures legal operation and demonstrates due diligence. Beyond avoiding fines, compliance frameworks provide structured approaches to implementing comprehensive security programmes.

UK organisations must prioritise compliance with the UK GDPR and the Data Protection Act 2018, as well as obtaining Cyber Essentials certification for government contracts, adhering to industry-specific regulations such as FCA requirements, and following NCSC guidance for public sector organisations.

Which Aspect Should You Prioritise First?

For most UK businesses, implement these aspects in this order:

1. Multi-factor authentication provides immediate, high-impact protection at relatively low cost. It can be deployed quickly and dramatically reduces account compromise risk.
2. Data encryption is typically available by default on modern cloud platforms and should be enabled immediately across all storage services.
3. Access reviews should begin within the first quarter, auditing who has access to what resources and removing unnecessary permissions.
4. Monitoring tools, particularly CSPM solutions, should be implemented within the first quarter to provide ongoing visibility and configuration management.
5. Compliance documentation is an ongoing requirement that should begin immediately but develops comprehensively over time as security programmes mature.
6. The National Cyber Security Centre recommends starting with Cyber Essentials certification, which covers these fundamental aspects and is required for UK government contracts.

Common Risks and Challenges in Cloud Security

Understanding the specific risks associated with cloud computing helps organisations develop targeted security strategies. These challenges require particular attention when building cloud security programmes.

The Shared Responsibility Model: Clarifying Who Does What

Understanding the shared responsibility model is critical to cloud security. Your cloud provider secures the infrastructure—physical data centres, network hardware, virtualisation platforms—whilst you’re responsible for securing your data, applications, and access controls.

This division varies by service model. In Infrastructure as a Service (IaaS), you manage more security components. In Software as a Service (SaaS), the provider manages more, but you always retain responsibility for your data.

A common misconception is that cloud providers handle all security. Under UK law, organisations remain data controllers under the GDPR, regardless of whether they use cloud hosting. You’re legally responsible for securing your data.

This is why the ICO investigates data controllers following cloud breaches, rather than cloud providers, unless the provider was negligent in its infrastructure responsibilities.

Data Breaches Through Misconfiguration

Cloud misconfigurations pose the most significant threat to cloud security. When cybercriminals gain unauthorised access through misconfigured systems, they compromise both confidentiality and business operations.

These incidents resulted in an average ICO fine of £875,000 in 2024. Common misconfigurations include publicly accessible storage buckets, overly permissive security group rules, disabled encryption, excessive IAM permissions, and unpatched systems.

The NCSC recommends automated patching for all cloud services within 14 days of security updates being released. Implementing automated configuration scanning tools helps identify misconfigurations before they can be exploited.

Insider Threats and Human Error

Insider threats emerge from employees or contractors with legitimate access who intentionally or unintentionally compromise security. These threats are challenging because perpetrators possess authorised access and understand internal systems.

Malicious insiders might steal intellectual property, sabotage systems, or sell access to external attackers. Negligent insiders create risks by failing to maintain proper security hygiene or mishandling sensitive data.

Mitigating insider threats requires implementing user behaviour analytics, enforcing least privilege access, conducting thorough background checks, implementing data access auditing, and fostering a security-conscious culture through regular training.

The NCSC emphasises that technical controls alone cannot prevent insider threats. Organisations must combine technology with appropriate policies and cultural initiatives.

API Vulnerabilities

Application Programming Interfaces enable communication between cloud services and applications. However, insecure APIs represent one of the fastest-growing threats to cloud security.

APIs can expose sensitive data if not properly authenticated. Common issues include broken authentication, allowing unauthorised access, excessive data exposure, lack of rate limiting, enabling automated attacks, and insufficient logging.

UK organisations must implement API gateways with authentication requirements, use OAuth 2.0 for API authentication, enable API activity logging, conduct regular security testing, and document all APIs for compliance audits.

Best Practices for Keeping Data Safe in the Cloud

Implementing cloud security effectively requires following established best practices that have proven successful across diverse organisations and threat scenarios. These practices provide a foundation for comprehensive security programmes.

Choose a Trusted Cloud Service Provider

Selecting a reputable cloud service provider is the foundation of cloud security. Trusted providers safeguard sensitive information against security threats and unauthorised access.

When evaluating providers, prioritise security features over cost. Conduct thorough due diligence regarding encryption practices, access controls, vulnerability management, and identity management protocols.

Verify the provider holds relevant certifications, including ISO 27001, SOC 2 Type II, Cyber Essentials Plus for UK government work, and industry-specific certifications such as PCI DSS.

Review the provider’s incident response history and transparency. Providers with established track records demonstrate maturity and reliability.

Major UK cloud providers, including AWS, Microsoft Azure, and Google Cloud, offer comprehensive security features that comply with UK regulations.

Use Strong Authentication Methods

Implement multi-factor authentication to add an extra layer of security when accessing cloud services. This involves combining something you know (a password), something you have (a unique code), and something you are (biometric data).

Deploy biometric authentication methods, such as fingerprint or facial recognition, to enhance security measures. Multiple verification factors significantly reduce the risk of unauthorised access.

Enforce password complexity requirements, including a minimum of 12 characters, combinations of upper and lower case letters, numbers and symbols, and the prohibition of common passwords.

Implement passwordless authentication where possible using hardware security keys, biometric authentication, or certificate-based authentication, eliminating password-related vulnerabilities entirely.

Regularly Update and Patch Systems

Maintaining a secure cloud environment requires regular system updates and patching. This practice fixes vulnerabilities in software and operating systems, reducing exploitation risks.

Implement automatic updates to ensure the latest security patches are applied promptly. Most cloud platforms offer automated patching services that can be configured during maintenance windows.

Regularly check for updates from trusted sources and apply them as soon as they are available. Subscribe to security bulletins from your cloud providers and software vendors.

Prioritise critical security updates to safeguard against emerging threats. Establish a risk-based approach addressing the most severe vulnerabilities first.

Conduct regular vulnerability scans to identify potential weaknesses, enabling timely remediation. These scans should occur at least monthly, with more frequent scanning for internet-facing systems.

Secure Endpoints

Securing endpoints is crucial for ensuring cloud data safety. Ensure that all devices accessing cloud resources—such as laptops, mobile phones, and tablets—have current security software and firewalls installed.

Implement robust access controls on devices to prevent unauthorised access to sensitive data. Device-level encryption ensures data remains protected if devices are lost or stolen.

Regularly update endpoint systems and applications to protect against emerging threats. Endpoint detection and response (EDR) solutions offer advanced threat protection that surpasses traditional antivirus software.

Educate employees on securing endpoints using strong passwords and avoiding risky internet browsing habits. Remote workers require particular attention as they often work on home networks with varying security levels.

Implementing mobile device management (MDM) solutions provides centralised control, enabling remote wipe capabilities and policy enforcement.

Define and Enforce Access Controls

Access controls define who can access what data and under what circumstances. This means setting up user permissions to limit the information each individual can access, edit, or share.

Enforcing strong access controls ensures only authorised personnel can access sensitive data, reducing the risk of breaches. This includes implementing multi-factor authentication, role-based access control, and robust password policies.

Regularly reviewing and updating these controls is crucial for adapting to changing security threats. Quarterly access reviews should verify that permissions remain appropriate as job roles change.

Implement just-in-time access for privileged operations. Rather than granting permanent administrative access, provide elevated privileges only when needed, then automatically revoke them.

Document access control policies clearly and ensure all staff understand their responsibilities.

Educate Employees on Security

Implement regular security training sessions for all employees to ensure they understand the importance of protecting sensitive data. Emphasise the significance of strong authentication methods and encryption techniques in safeguarding sensitive information stored in the cloud.

Educate staff about recognising and reporting potential security threats, such as phishing attempts and suspicious email attachments, to enhance overall cybersecurity awareness within the organisation.

Share informative resources on best practices for maintaining data privacy and securing endpoints with employees. Make security training engaging and relevant to employees’ daily work rather than generic presentations.

Encourage a culture of vigilance by promoting constant system updates and patching to mitigate vulnerabilities that cyber attackers could exploit. Recognise and reward employees who identify and report security issues.

Conduct simulated phishing exercises to test employee awareness and identify areas requiring additional training. These exercises should be educational rather than punitive, focusing on learning opportunities.

Future Trends in Cloud Security

Cloud security continues to evolve rapidly as threats become more sophisticated and cloud adoption accelerates. Understanding emerging trends helps organisations prepare for future challenges and opportunities.

AI-Driven Security Solutions

Artificial intelligence and machine learning increasingly power cloud security solutions. By continuously analysing vast amounts of data, AI algorithms quickly identify potential threats and vulnerabilities, enabling proactive risk mitigation.

These technologies automate threat detection and response, strengthening overall cybersecurity posture. AI-driven solutions excel at identifying suspicious patterns that human-centric approaches might miss.

With the ability to adapt and learn from new data, these solutions tackle evolving cyber threats effectively. They detect zero-day exploits, advanced persistent threats, and subtle indicators of compromise that traditional systems miss.

UK organisations should evaluate AI-powered security tools from established vendors whilst maintaining human oversight. AI augments rather than replaces security teams, providing powerful capabilities when combined with human expertise.

Multi-Cloud Security

Multi-cloud security involves securing data and applications across multiple cloud platforms. As businesses increasingly utilise multiple cloud providers, ensuring data remains safe across all platforms becomes essential.

Implementing consistent security measures, access controls, and encryption protocols across all clouds prevents unauthorised access and data breaches. This requires unified security management platforms providing visibility across diverse cloud environments.

By adopting a multi-cloud security strategy, organisations can mitigate cyber threat risks and ensure the integrity of their digital information. Multi-cloud approaches also reduce vendor lock-in and improve resilience through redundancy.

The challenge lies in managing complexity. Each cloud provider has unique security features, APIs, and management interfaces. Organisations need skilled staff or managed security services to effectively handle multi-cloud environments.

Zero-Trust Architecture

Implementing zero-trust architecture means not automatically trusting anyone or anything inside or outside of the network. It involves verifying and validating every access request to systems and data, regardless of origin.

This approach ensures that even if a threat actor gains network access, they cannot move freely within it. With zero-trust architecture, organisations enforce strict access controls and continuously monitor for signs of compromise.

This security model significantly reduces vulnerability to data breaches and cyber-attacks whilst enhancing overall cloud security measures.

The NCSC promotes zero-trust principles as part of their guidance for government departments and encourages private sector adoption. Implementation typically begins with identity verification, then progressively adds device trust, network segmentation, and continuous monitoring.

Cybersecurity Dark Web Monitoring

The dark web serves as a marketplace for cyber threats and illegal activities, making it essential to monitor this hidden network for potential security risks. Organisations can stay ahead of potential breaches by actively tracking the dark web for stolen credentials, sensitive information, or impending threats.

Cybersecurity dark web monitoring plays a crucial role in early threat detection and mitigation, enabling the identification of compromised data before it leads to significant breaches. Monitoring services provide real-time alerts about compromised employee credentials or leaked company information.

This enables swift action to mitigate risks and prevent unauthorised access to sensitive data. UK organisations handling sensitive information should consider incorporating dark web monitoring into their threat intelligence programmes.

Dark web monitoring services scan hidden forums, marketplaces, and chat channels for mentions of your organisation or compromised credentials. Early warning allows proactive response before attackers exploit compromised information.

Cloud security represents one of the most critical challenges facing UK organisations today. As digital transformation accelerates and cyber threats become increasingly sophisticated, implementing comprehensive security measures is essential for protecting sensitive data, maintaining regulatory compliance, and preserving customer trust.

The essentials of cloud security—encryption, access management, continuous monitoring, and compliance governance—form the foundation of effective protection. By implementing multi-factor authentication, enforcing least privilege access, encrypting data comprehensively, and choosing certified cloud providers, organisations dramatically reduce their risk exposure.

UK-specific requirements add layers of complexity but also provide structured frameworks for building robust security programmes. Organisations that embrace these requirements gain a competitive advantage through enhanced trust and eligibility for government contracts that require Cyber Essentials certification.

Looking forward, emerging technologies such as AI-driven security, zero-trust architectures, and advanced threat monitoring will significantly reshape cloud security landscapes. Organisations that stay informed and adapt their security strategies will maintain strong defensive positions against evolving threats.

The journey to comprehensive cloud security requires ongoing commitment, regular assessment, and continuous improvement. Start with the fundamentals—implement MFA, enable encryption, conduct access reviews, and deploy monitoring tools. The safety of your data in the cloud depends on people, processes, and culture working together to create resilient and trustworthy digital environments.