A newly registered company gets a domain, a bank account and its first customer data within weeks, and each of those is something an attacker can target. CERT-In handled 20,41,360 cyber security incidents in 2024, up from 15,92,917 in 2023, and IBM puts the average cost of a data breach in India at ₹22 crore in 2025. This checklist sets out what to secure first and which Indian rules already apply to you.
Why a new company needs a security baseline from the start
Small companies are not too small to be targeted. Verizon's 2025 Data Breach Investigations Report counted 3,049 incidents at small businesses, 2,842 of them with confirmed data disclosure, and found that 99% of those breaches were financially motivated. Ransomware appeared in 88% of breaches at small and medium businesses, against 39% at larger organisations. The attacker is usually after money, and a young company with weak controls is easier to squeeze than a bank.
The Indian numbers point the same way. IBM's 2025 study found the average breach in India cost ₹22 crore, about 13% more than in 2024, and took 263 days to identify and contain. Phishing was the most common starting point at 18%, followed by third-party and supply chain compromise at 17% and vulnerability exploitation at 13%. Most of these causes are addressed by basic controls that cost little when set up early.
The legal baseline: CERT-In directions and the DPDP Rules
CERT-In's directions of 28 April 2022, in force from 28 June 2022, require notifiable incidents to be reported within 6 hours of noticing them. Logs for all ICT systems must be kept securely for a rolling 180 days within India, and system clocks must sync with NIC or NPL time servers. Organisations must also name a point of contact for CERT-In. Failing to report or comply can attract up to one year of imprisonment, a fine of up to ₹1 lakh, or both.
The Digital Personal Data Protection Rules were notified on 13 November 2025, and the full regime, including breach duties, becomes enforceable on 13 May 2027. Rule 6 lists safeguards such as encryption, masking, access control, logs and backups, and Rule 8 asks for processing logs to be kept for at least one year. A breach must be reported to the Data Protection Board without delay, with a detailed report within 72 hours. Penalties reach ₹250 crore for inadequate safeguards and ₹200 crore for failing to report.
| Rule | What it requires | Practical step for a new company |
|---|---|---|
| CERT-In directions (2022) | Report notifiable incidents within 6 hours | Write a one-page incident plan with names and phone numbers |
| CERT-In directions (2022) | Keep ICT logs for a rolling 180 days in India | Turn on audit logs in your email suite, cloud and firewall |
| CERT-In directions (2022) | Sync clocks with NIC or NPL time servers | Point servers and network devices at an approved NTP source |
| DPDP Rules 2025, Rule 6 | Encryption, access control, logs, backups | Encrypt laptops, limit admin rights, test restores |
| DPDP Rules 2025, Rule 8 | Keep processing logs for at least one year | Set log retention to cover both rules |
| DPDP Rules 2025 | Detailed breach report to the Board within 72 hours | Keep a breach register and a draft notice ready |
Identity and accounts come first
Most of the damage in a small company starts with one compromised login, so accounts are the first job. Microsoft states that multifactor authentication can block more than 99.2% of account compromise attacks, and its security defaults, which require MFA registration for all users and block legacy sign-in protocols such as IMAP, SMTP and POP3, come at no extra cost. Google's small business checklist asks admins to enforce 2-Step Verification, starting with people who handle financial or employee data.
Give every person their own account rather than sharing logins, and keep administrator rights for daily work separate from the account you use to read email. Google recommends a second super admin so that losing one account does not lock the company out, plus recovery details and printed backup codes stored safely. Keep the registrar and DNS logins in the same protected place, because whoever controls DNS controls your email.
- Turn on MFA or 2-Step Verification for every account, admins first
- Create a second super admin and store recovery codes offline
- Use unique, long passwords kept in a password manager
- Remove accounts the same day someone leaves
Protect your email domain before you send a single invoice
Email is where Indian breaches most often begin, and a new domain without authentication is easy to spoof. Gmail requires every sender to set up SPF or DKIM, and senders of more than 5,000 messages a day must also publish DMARC, align the From domain and keep the spam rate below 0.3%. Google's small business checklist also lists SPF as a baseline step and recommends turning on enhanced pre-delivery scanning and extra screening of attachments and links.
Publish SPF, DKIM and a DMARC record at p=none when you set up mail, then read the DMARC reports and move to a stricter policy once every legitimate sender passes. This protects your customers from fake invoices sent in your name and keeps your own mail out of spam folders. Train the team to verify any change in bank details by phone, because payment fraud usually arrives as a polite email.
Devices, updates and backups
Ransomware was present in 44% of all breaches in the 2025 DBIR, so assume a laptop or server will one day be encrypted and plan to recover without paying. Encrypt every company laptop, turn on automatic updates for operating systems, browsers and apps as Google's checklist recommends, and use a device management tool once you have more than a handful of machines. Remove local admin rights from daily user accounts.
Backups appear in the DPDP Rules' list of reasonable security safeguards, and they are your answer to ransomware. Keep at least one copy that a compromised admin account cannot delete, such as an immutable or offline copy, and test a restore before you need one. Back up your cloud email and file storage too, because a deleted mailbox in a SaaS suite is not always recoverable after the retention window closes.
Logging, time sync and incident readiness
The CERT-In directions expect logs to exist and to be handed over with an incident report, and the DPDP Rules ask for processing logs to be kept for at least one year. The simplest approach for a young company is to switch on audit logging in its email suite, cloud accounts and firewall, send those logs to one place, and set retention to at least a year so that both rules are covered.
The 6-hour CERT-In window is short, so decide in advance who calls whom. Name the CERT-In point of contact, list your key vendors with support numbers, and keep a short checklist for the first hours: contain, preserve logs, assess whether personal data is involved, and report. Run through it once with the team so the plan has been read before it is needed.
Vendors and third parties
Third parties were involved in 30% of breaches in the 2025 DBIR, double the share a year earlier, and IBM found supply chain compromise behind 17% of Indian breaches. A new company relies on payroll tools, CRMs, payment gateways and freelancers from its first month, and each one holds some of your data or access to your systems.
Keep a simple register of every vendor that touches personal or financial data, what it can access and who owns the relationship. The DPDP Rules expect security clauses in contracts with data processors, so add breach notification, deletion on exit and audit rights to your standard terms. Give freelancers named accounts with MFA rather than shared passwords, and remove their access when the work ends. XDQ Labs runs authorised security reviews for small teams that want an outside check of this setup.
The checklist in one table
Work through this list in order. The early items cost little or nothing and close the routes that the Verizon and IBM data show attackers use most often: stolen credentials, phishing and third-party access. The later items take more effort but are what the CERT-In directions and the DPDP Rules will expect you to show if something goes wrong.
| Area | Action | Why it matters |
|---|---|---|
| Accounts | MFA for all users, second super admin, no shared logins | MFA blocks over 99.2% of account compromise attacks |
| SPF, DKIM and DMARC on your domain | Gmail requires SPF or DKIM from every sender | |
| Phishing | Payment change verification by phone, staff awareness | Phishing started 18% of Indian breaches in 2025 |
| Devices | Disk encryption, automatic updates, no local admin | Ransomware appeared in 88% of SMB breaches |
| Backups | Immutable or offline copy, tested restores | Listed as a safeguard in DPDP Rule 6 |
| Logs | Central audit logs kept for at least one year | 180 days under CERT-In, one year under DPDP Rule 8 |
| Incidents | Named CERT-In contact and a written plan | Reporting window of 6 hours |
| Vendors | Vendor register and security clauses in contracts | Third parties involved in 30% of breaches |
Frequently asked questions
How quickly must a cyber incident be reported to CERT-In?
Under CERT-In's directions of 28 April 2022, notifiable cyber security incidents must be reported within 6 hours of noticing them or being told about them. Failing to report can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both, so name a contact person and keep a plan ready.
When do the DPDP Rules 2025 apply in full?
The rules were notified on 13 November 2025. Consent manager provisions start on 13 November 2026, and the full regime, including breach notification and security safeguards, becomes enforceable on 13 May 2027. Penalties for inadequate safeguards can reach ₹250 crore, so it is sensible to build the controls now.
How long should a company in India keep security logs?
CERT-In requires logs of all ICT systems to be kept for a rolling 180 days within India. The DPDP Rules ask for personal data processing logs to be kept for at least one year. Setting retention to at least one year in one central place covers both requirements.
What is the cheapest first security step for a new company?
Turn on multifactor authentication for every account. Microsoft says MFA can block more than 99.2% of account compromise attacks, and its security defaults are free. Google Workspace includes 2-Step Verification on every plan. Start with administrators and anyone who handles money or employee data.
Sources
- Cyber Security: India revamps rules on mandatory incident reporting and allied compliances (CERT-In Directions, 28 April 2022), Nishith Desai Associates, 2022
- India notifies its sweeping Digital Personal Data Protection Rules, Biometric Update, 2025
- DPDPA Rules 2025: detailed brochure, Grant Thornton Bharat, 2025
- Cybersecurity incidents surge by 76.25% in 5 years, reveals minister in Rajya Sabha, The Tribune, 2025
- India Records Highest Average Cost of a Data Breach: IBM Cost of a Data Breach Report 2025, IBM India Newsroom, 2025
- 2025 Data Breach Investigations Report news release, Verizon, 2025
- 2025 Data Breach Investigations Report (full report), Verizon Business, 2025
- Security checklist for small businesses (1 to 100 users), Google Workspace Admin Help, 2026
- Security defaults in Microsoft Entra ID, Microsoft Learn, 2026
- Email sender guidelines, Gmail Help, 2026
