Cybersecurity Basics for Small Businesses in India

Indian small businesses lose money to invoice fraud, fake UPI requests, and mailbox takeovers more often than Hollywood-style hacks. You do not need an enterprise SOC on day one — you need basics done consistently.

Identity and email first

Turn on MFA for Google Workspace/Microsoft 365 and banking portals. Use a password manager. Stop shared WhatsApp-only “admin passwords.” Compromise of owner email is often enough to redirect vendor payments.

Payments and vendor verification

Confirm bank detail changes on a known phone number, not only email. Train staff against urgent payment scams. Dual control for large transfers helps even in a 5-person team.

Devices and backups

Keep OS updated, disk encryption on, and automatic backups of accounting data (with an offline/cold copy). Lost laptops without encryption are data breaches.

• Least-privilege access to Tally/books and drive folders
• Offboard employees the same day — revoke mail and VPN
• Write a one-page incident plan: who to call, what to freeze

FAQ

Do we need expensive antivirus?

Start with updates, MFA, backups, and browser hygiene. Add endpoint tools as you grow — process beats stickers.

Key takeaway

Most SME breaches are preventable with MFA, verification calls, and backups.