SMB breaches are rarely sophisticated — they are unlocked doors: shared passwords, ex-employees with live access, backups nobody tested, and one convincing phishing WhatsApp. The fixes are correspondingly unglamorous. Here is the checklist that prevents the actual failure modes, runnable this month.
Access (where most breaches start)
- One person, one account, always — shared logins make departures dangerous and audits impossible.
- Offboarding same-day: a written checklist revoking email, systems, admin panels, and payment access the day someone leaves. Ex-employee access is India's quietest breach vector.
- MFA on everything that matters: email first (it resets everything else), then banking, admin panels, and cloud consoles.
- Least privilege: the intern does not need database access; roles in your systems should mirror roles in your org (RLS-grade enforcement where the software allows).
Data (assume the bad day)
- Automated backups with a quarterly restore drill — the twenty-minute rehearsal that separates incidents from extinctions.
- Encrypt in transit and at rest — HTTPS everywhere and managed-platform defaults get you most of this free.
- Know where personal data lives: customer lists, KYC files, payroll — mapped, minimized, and retention-limited. This is DPDP hygiene as much as security: consent, purpose limitation, and erasure capability are legal obligations now, not aspirations.
People (the actual attack surface)
- Phishing awareness, quarterly and brief: the finance-team "urgent payment" WhatsApp and the fake-invoice email are the two Indian SMB classics; ten minutes of examples beats an annual seminar.
- Payment change verification: any change to vendor bank details confirmed on a known phone number — this single rule blocks the costliest fraud pattern in SMB India.
- A written incident plan: who is called, what is isolated, who informs customers — one page, printed, findable during panic.
Vendors and software
- Update discipline: unpatched software is the standing invitation (maintenance is security).
- Vendor questions before signing: where is data stored, who accesses it, what is the breach notification commitment (the same DPA logic as AI vendors).
- Custom software: security in the acceptance criteria — auth standards, audit logs, dependency policy — not assumed.
Cost honesty
Nearly everything above is process, not purchase: ₹0 plus discipline. The paid layer — a security review of your custom systems — runs ₹0.5–2L and is worth it once real customer data flows. Ask us for one; we review what we did not build, too.
Frequently asked questions
What are the most common causes of SMB data breaches?
Unlocked doors, not sophistication: shared passwords, ex-employees with live access, untested backups, phishing WhatsApps to finance teams, and fake vendor bank-detail changes. The fixes are process discipline, not expensive tools.
What security should an SMB implement first?
MFA on email (it resets everything else), one-person-one-account, same-day offboarding checklists, automated backups with a quarterly restore drill, and payment-change verification on known phone numbers — that last rule alone blocks India's costliest SMB fraud.
What does DPDP compliance require from small businesses?
Knowing where personal data lives (customers, KYC, payroll), collecting with consent and purpose limitation, retention limits, access controls, and the ability to honor erasure requests. Security hygiene and DPDP hygiene are largely the same work.
How much does SMB security cost?
Almost everything preventive is free — process and discipline. The paid layer, a security review of custom systems handling real customer data, runs ₹0.5–2 lakh and is worthwhile once volumes are real.