IT Security Best Practices for Indian SMEs and Enterprises

India recorded over 13 million cybersecurity incidents in 2024 — targeting businesses of all sizes across every sector. Meanwhile, the DPDP Act 2023 now mandates that organisations implement reasonable security safeguards to protect personal data, with penalties of up to ₹250 crore for breaches caused by inadequate security. The question for Indian businesses is no longer whether to invest in security — it's where to start.

Layer 1: Identity & Access Security

The majority of cyber attacks begin with compromised credentials. Controlling who has access to what — and how they authenticate — is the single highest-impact security investment a business can make.

• Enable Multi-Factor Authentication (MFA) for all critical systems: email, VPN, cloud consoles, banking, and HR systems. TOTP-based MFA (e.g., Google Authenticator) is sufficient for most businesses; hardware tokens for privileged accounts.
• Implement least-privilege access: employees should only have access to the data and systems they need for their role. Audit and remove unnecessary access regularly.
• Offboarding checklist: revoke all system access, email accounts, and VPN credentials immediately when an employee leaves — ideally on the last day of employment.
• Privileged Account Management: administrator and root accounts should be used only when necessary, with audit logging enabled for all privileged actions.

Layer 2: Endpoint Security

Every laptop, desktop, mobile device, and server is a potential attack surface. Endpoint protection is the security layer most visible to employees and the most frequently neglected.

• Deploy EDR (Endpoint Detection & Response): traditional antivirus is insufficient against modern threats. EDR tools provide behavioural analysis and threat response capabilities.
• Enforce OS and software patch management: unpatched systems are the most common attack vector. Automate patch deployment where possible; target a maximum 14-day patch cycle for critical patches.
• Mobile Device Management (MDM): manage and secure company-owned and BYOD devices — enforce encryption, passcode policies, and remote wipe capability.
• USB and peripheral controls: restrict or log USB device usage to prevent data exfiltration.

Layer 3: Network Security

• Segment your network: keep critical systems (finance, HR, production) on separate network segments from general office use. This limits lateral movement in the event of a breach.
• VPN for remote access: all remote access to company resources should be through an authenticated VPN. Direct RDP/SSH access from the internet is a major risk.
• Firewall configuration review: firewall rules accumulate over time. Conduct an annual review to remove unnecessary rules and verify that only required ports are open.
• DNS filtering: block malicious domains at the DNS layer — a cost-effective first line of defence against phishing and malware C2 communication.

Layer 4: Application Security

• Vulnerability Assessment & Penetration Testing (VAPT): conduct external and internal VAPT at least annually, and after major application changes. Web application VAPT is critical for any customer-facing platform.
• Secure coding practices: ensure your development team follows OWASP Top 10 guidelines. Conduct code reviews with security focus before major releases.
• Dependency management: track third-party libraries and frameworks. CVE scanning in your CI/CD pipeline catches known vulnerabilities before they reach production.
• WAF (Web Application Firewall): deploy a WAF in front of public-facing web applications to filter common attack patterns.

Layer 5: Data Security

• Encrypt sensitive data at rest and in transit: use TLS 1.2+ for data in transit; AES-256 for data at rest. This is a baseline requirement under the DPDP Act.
• Data Loss Prevention (DLP): implement controls to prevent sensitive data from leaving the organisation via email, cloud uploads, or USB devices.
• Backup strategy — the 3-2-1 rule: maintain 3 copies of critical data, on 2 different media types, with 1 offsite or cloud copy. Test restoration monthly.
• Data classification: classify data by sensitivity (public, internal, confidential, restricted) and apply appropriate controls to each category.

Layer 6: Security Awareness

Technology controls can only do so much — the majority of security incidents involve a human element. Phishing remains the most common attack vector in India.

• Conduct security awareness training for all employees at least annually — covering phishing recognition, password hygiene, social engineering, and data handling.
• Run simulated phishing exercises quarterly to measure and improve employee resilience.
• Establish a clear, low-friction process for employees to report suspected phishing or security incidents.

Layer 7: Incident Response

Despite all preventive controls, incidents happen. How quickly and effectively you respond determines the business impact of a breach.

• Develop a written Incident Response Plan: define what constitutes an incident, escalation paths, communication templates (internal, customer, DPDP Board notification), and recovery procedures.
• Test the plan: conduct tabletop exercises at least annually. Identify gaps before a real incident forces you to find them under pressure.
• Assign an Incident Response owner: one person should be accountable for coordinating the response to any significant security event.

DPDP Act security requirements

The DPDP Act requires organisations to implement "reasonable security safeguards to prevent personal data breaches". While the Act does not specify exact technical standards, the following are considered baseline controls by the industry: