Guide
The IT security floor for an Indian small business: twelve things, none of them expensive
By Samuel Marndi · Updated
The short answer
The overwhelming majority of small-business security incidents in India are not sophisticated. They are a shared admin password, an ex-employee whose email was never disabled, a backup that silently stopped, a firewall left on factory defaults, or someone paying an invoice that was edited in transit. None of these are stopped by buying a product; all of them are stopped by a routine.
If you do only three things, do these: enforce multi-factor authentication on email, give every person their own account so leavers can actually be removed, and test-restore a backup this month. Those three cover the failure modes that account for most real-world damage to businesses of this size.
The twelve, in the order worth doing them
| # | Control | Why it is on the list | Typical cost |
|---|---|---|---|
| 1 | MFA on email and every internet-facing system | Stops a stolen password from becoming a breach | Included in most licences |
| 2 | One account per person, no shared logins | Without it, offboarding is impossible to do properly | Licence cost only |
| 3 | Documented leaver checklist, run every time | Dormant accounts are the most common audit finding | Nil |
| 4 | Backups on a 3-2-1 pattern | Two copies on one site is not a backup strategy | Storage cost |
| 5 | A test restore, recorded, at least quarterly | An untested backup is a hope | An hour of someone's time |
| 6 | Remove local admin rights from daily accounts | Contains most malware to one user's profile | Nil |
| 7 | Firewall firmware current, defaults changed | Default credentials remain a live entry route | Nil to a subscription |
| 8 | Patching on a schedule, with a compliance report | Known, patched vulnerabilities cause most incidents | Time or a service |
| 9 | Endpoint protection verified on every device | Deployed and actually running are different things | ₹500–₹2,000 per device / year |
| 10 | Payment-change verification by phone callback | Defeats invoice-interception fraud, which is common | Nil |
| 11 | Guest Wi-Fi separated from the business network | Stops a visitor's laptop reaching your file server | Nil on business hardware |
| 12 | Written record of who has access to what | You cannot secure what nobody has listed | Nil |
Why the boring items are at the top
There is a strong pull towards buying something — a next-generation firewall, an endpoint suite, a security audit. Those have their place, but they sit above a floor that most businesses have not built, and a product bought before the floor is in place mostly generates alerts nobody acts on.
The items ranked one to five are all process, not purchase. They cost almost nothing and they close the routes that actually get used against businesses this size. If a vendor proposes a product before asking whether your leavers are being offboarded and whether your backups restore, they are selling rather than advising.
The offboarding checklist, in full
This is the single most commonly skipped routine in Indian SMBs and the one that shows up most often when I audit a new client's environment. Run it identically every time, and record that you ran it.
- Disable the email account the same day — disable, do not delete, so the mailbox is preserved
- Convert or delegate the mailbox to their manager for handover
- Revoke cloud and application access: file storage, CRM, accounting, project tools
- Rotate any shared credential the person knew — and note which ones those were
- Revoke VPN, remote access and any firewall user account
- Remove building, door and biometric access, and collect cards
- Retrieve company devices; wipe and re-image before reissuing
- Remove them from mailing lists, WhatsApp groups and shared calendars
- Transfer ownership of any file, domain or account registered in their name
- Record the date each step was completed, and by whom
What actually needs spending on
Once the floor is in, the spending that reliably returns value is narrow. A properly configured business firewall with a current subscription, because an unlicensed appliance stops receiving the threat updates that justify it. Endpoint protection with central visibility, so "is it running everywhere?" is a dashboard rather than a survey. And off-site backup with a copy the network cannot reach, because ransomware encrypts the backup drive it can see.
Beyond that, the highest-return investment for a business of this size is usually not a product at all — it is thirty minutes of staff training on payment fraud and phishing, repeated. The most expensive incidents I see at this scale involve no malware whatsoever: someone changed the bank details on an invoice, and someone else paid it.
FAQ
Related questions
What is the most important security control for a small business?
Multi-factor authentication on email. Business email is both the target and the route to everything else — password resets, payment instructions, cloud services. MFA is included in most Microsoft 365 and Google Workspace licences you already pay for, and it defeats the single most common attack against businesses this size.
Do small businesses in India really need a firewall?
If you have an office network, a server, or staff connecting remotely, yes — with a current subscription and default credentials changed. What you do not need is an enterprise appliance sold on features you will never configure. A right-sized firewall that is actually maintained beats an expensive one that is not.
How often should backups be tested?
At least quarterly, by restoring an actual file and recording that you did. Untested backups fail at a rate that surprises everyone, and the moment you discover it should not be the moment you need it. Follow a 3-2-1 pattern: three copies, two media types, one off-site and out of reach of your network.
What should happen when an employee leaves?
Run the same written checklist every time: disable email the same day, delegate the mailbox, revoke cloud and application access, rotate shared credentials they knew, remove VPN and building access, retrieve and wipe devices, and transfer anything registered in their name. Record who completed each step. Dormant accounts belonging to departed staff are the most common finding in SMB audits.
Is antivirus enough for a business?
Endpoint protection is necessary and not sufficient. It does nothing about a shared password, an unpatched firewall, an account that was never disabled, or an invoice with edited bank details. Treat it as one of twelve controls rather than the answer to the question.
How much should a small business spend on IT security?
Most of the meaningful controls cost nothing but attention — MFA, individual accounts, offboarding, removing admin rights, changing defaults. Real spend concentrates on endpoint protection at roughly ₹500–₹2,000 per device per year, a maintained firewall subscription, and off-site backup storage. Spending beyond that before the free controls are in place buys very little.