Security Setup

How to Set Up Cybersecurity for Your Indian SME — 9-Step 2026 Roadmap

Indian SMEs face 265M+ cyber attacks per year (CERT-In 2024 data) — phishing, ransomware, credential theft, and supply-chain attacks. Most SMEs have weak defences not because they cannot afford security, but because they do not know where to start. Below is the practical 9-step cybersecurity setup for Indian SMEs (10-200 employees), in order of impact-per-rupee.

Step 1 — Enforce Multi-Factor Authentication (MFA) everywhere: Highest-impact, near-zero-cost. Enforce MFA on: email (Google Workspace / Microsoft 365), CRM (Zoho, Salesforce), accounting (Zoho Books, Tally), banking, social media business accounts. MFA blocks 99%+ of credential-based attacks. For Indian SMEs, Google / Microsoft authenticator apps are free. Mandate for all employees in week 1.
Step 2 — Endpoint security on every laptop / device: Install endpoint security (EDR) on every employee laptop. Best Indian options: Trend Micro Worry-Free Business Security (~₹2,500/endpoint/year), Sophos Intercept X (~₹3,000/endpoint/year), CrowdStrike (~₹5,000/endpoint/year). Centralised management console — IT can see threats across all devices. Average cost ~₹2-3 lakh/year for 50 employees.
Step 3 — Email security (anti-phishing, anti-spam): Microsoft 365 includes Defender for Office 365 (Business Premium ₹1,560/user/month) with strong anti-phishing. Google Workspace has equivalent Workspace Security. For standalone email, use Proofpoint, Mimecast, or Cisco Secure Email Cloud. Email is the entry point for 80%+ of cyber attacks on Indian SMEs.
Step 4 — Backup data on cloud (3-2-1 rule): Implement 3-2-1 backup: 3 copies of data, 2 different media, 1 off-site. For Indian SMEs: (a) primary in cloud SaaS (Microsoft 365 / Google Workspace), (b) automated backup of cloud data to Druva or Spanning (~₹100-300/user/month), (c) local copy of critical data on encrypted external drive monthly. Backup is your ransomware protection.
Step 5 — Patch management (OS + applications): Outdated software is the #2 attack vector after phishing. Enable auto-updates for: Windows 11 / macOS, Microsoft 365 apps, web browsers (Chrome, Edge, Firefox), antivirus signatures. For business-critical applications (Tally, ERP), schedule monthly patch windows. Use Microsoft Intune (with Business Premium) or ManageEngine Patch Manager (~₹50,000-₹2 lakh/year for 50 endpoints) for centralised patching.
Step 6 — Network security: firewall + secure Wi-Fi: For office networks: business-grade firewall (Sophos XG, Fortinet, Palo Alto) with intrusion prevention. Cost: ₹40,000-1.5 lakh hardware + ~₹15,000-50,000/year support. For Wi-Fi: WPA3 encryption, separate guest network, MAC filtering. For 100% remote teams, this is replaced by SASE / Zero Trust Network Access from cloud (Cloudflare for Teams, Zscaler).
Step 7 — Security awareness training for employees: Humans are the weakest link. Run quarterly security awareness training: phishing simulation, password hygiene, social engineering recognition. Indian options: KnowBe4 (~₹200-500/employee/year), Cyber Awareness India (free / open source), or quarterly internal sessions. Combined with simulated phishing tests, this reduces successful phishing by 70-90%.
Step 8 — Incident response plan and CERT-In compliance: Document: (1) Who to call in an incident (CIO/founder, CERT-In, external security firm), (2) Communication plan (employees, customers, regulators), (3) CERT-In reporting (mandatory within 6 hours for certain incident types). Practice via tabletop exercises 2x/year. For Indian SMEs, this is mandatory under CERT-In 2022 directions and DPDP Act 2023.
Step 9 — Annual third-party security audit / VAPT: Once basic security is in place, get an annual Vulnerability Assessment and Penetration Testing (VAPT) from an independent firm. Cost: ₹50,000-2 lakh depending on scope. VAPT finds vulnerabilities your internal team missed and is often required by enterprise customers / regulators. For Indian SMEs working with BFSI or healthcare clients, VAPT is mandatory.

Frequently Asked Questions

How much should an Indian SME spend on cybersecurity?

Industry benchmark: 5-10% of IT budget. For a 50-person Indian SME with ₹30 lakh/year IT spend, security spend should be ₹1.5-3 lakh/year. Breakdown: endpoint security ₹1.5 lakh, email security included in M365 Business Premium, MFA free, backup ₹50,000, training ₹30,000, annual VAPT ₹50,000-1 lakh.

What is the highest-impact security investment for Indian SMEs?

MFA across all critical systems — highest impact at near-zero cost. Blocks 99%+ of credential-based attacks. After MFA, endpoint security (EDR) is the next highest-impact spend. Together, these two address ~85% of common cyber threats to Indian SMEs.

Is CERT-In compliance mandatory for Indian SMEs?

Yes, since April 2022 CERT-In directions. All Indian service providers and corporates must: (1) Synchronise system clocks with NPL, (2) Report security incidents to CERT-In within 6 hours, (3) Maintain logs for 180 days. For Indian SMEs handling customer data, compliance is essential — fines start at ₹1 lakh per day for non-compliance with reporting obligations.

Should small Indian businesses use free antivirus or pay for endpoint security?

For business use, pay for endpoint security (EDR). Free antivirus (Windows Defender, free Avast) provides basic signature-based detection only. EDR products (Trend Micro, Sophos, CrowdStrike) add: behaviour-based detection, ransomware rollback, centralised management, threat hunting. Cost ~₹2,500-5,000/endpoint/year is one of the highest-ROI security spends.

How do I get started if I have no IT security expertise in my Indian SME?

Three options: (1) Hire a part-time vCISO (Virtual CISO) — typically ₹50,000-1.5 lakh/month for 1-2 days/week of senior security oversight. (2) Outsource to a Managed Security Service Provider (MSSP) — ~₹1-3 lakh/month for 24/7 monitoring + incident response. (3) Start with our authorised security partner program — we set up the basics (MFA, EDR, backup, training) for a fixed ₹2-5 lakh project. After basics are in place, you can add a vCISO or MSSP for ongoing operations.

Free cybersecurity assessment for Indian SMEs — actionable 9-step roadmap in 1 day.