Small-business security that starts where the money leaks.

Not in general. CERT-In’s 15 Elemental Cyber Defense Controls, published on 1 September 2025, say MSMEs “may” assess themselves and “may” have a CERT-In-empanelled auditor carry out a baseline audit once a year — a recommendation, not a requirement. An audit becomes mandatory for you when a regulator, a government buyer or a customer contract demands one. What is already law for every company is the April 2022 CERT-In Directions: six-hour incident reporting, 180-day logs and a named point of contact. SemperWise is not CERT-In empanelled; where a contract requires an empanelled auditor, we prepare you for that audit and say so up front.

They are CERT-In’s minimum baseline for MSMEs: effective asset management; network and email security; endpoint and mobile security; secure configuration; patch management; incident management; logging and monitoring; awareness and training; third-party risk management; data protection, backup and recovery; governance and compliance; a “Robust Password Policy”; access control and identity management; physical security; and vulnerability audits and assessments. Together they carry 45 numbered recommendations, from asset inventories to an annual independent vulnerability assessment. The self-check on this page asks one plain question per control.

Yes. The Digital Personal Data Protection Act has no turnover or size threshold, so a clinic’s patient records, a CA firm’s client files and a trader’s customer list are all in scope if they are held digitally. Section 17(3) lets the government exempt notified classes of business, startups included, from some duties — but none has been notified, and the exemption cannot remove the duty to keep reasonable security safeguards or to report a breach. The main obligations apply from about 13 May 2027. Penalties reach ₹250 crore, though the Board must weigh a penalty’s likely impact on the business. A DPDP readiness assessment sizes the work for a firm like yours.

Call 1930, the national cyber-fraud helpline, or file on cybercrime.gov.in straight away, then call your bank’s fraud line and ask for the transfer to be recalled or the receiving account frozen. If the money went to a US account, also file with the FBI’s IC3 portal — that is how the Indore company got its ₹3.72 crore back. Keep every email and header; do not delete anything. If the fraud involved unauthorised access to your email or systems, assess whether it is on CERT-In’s list of reportable incidents, because that clock is six hours. Speed is what separates a recovery from a loss.

Check the QR code at the counter every morning: scan it with your own phone and confirm the name that appears is your business. Keep QR standees where staff can see them, and replace any that look re-stuck or reprinted. Never send a customer a QR image over WhatsApp as a payment request without confirming it is your own, and never accept a customer’s screenshot as proof — confirm on your soundbox, bank app or settlement statement. The Delhi case that came to light in December 2025 involved edited QR codes that looked identical to the originals, so the name check is what matters, not how the code looks.

We could not find a central one. The Ministry of MSME’s 2025–26 scheme booklet does not mention cyber security at all, and lists its Digital MSME scheme as yet to be launched. What does exist is free: CERT-In’s Cyber Swachhta Kendra alerts and tools, government awareness sessions, and the 1930 helpline and cybercrime.gov.in for reporting fraud. Some state governments run their own programmes, so check with your state’s MSME or IT department before you spend. Be wary of anyone selling a “government-mandated” package; the MSME controls themselves are voluntary.

It depends almost entirely on scope — one website, or a website plus remote access, an office network and a cloud account — which is why we do not publish a price list: any single number would be wrong for most readers. We scope in a 30-minute call at no charge, then send a written scope and a fixed price, with a retest of fixes included. For most small firms the right first purchase is small: an assessment of the website and whatever else faces the internet. If we think you do not need testing yet, we will tell you what to do instead.

The April 2022 CERT-In Directions apply to every “body corporate”, and the IT Act’s definition of that term includes firms and sole proprietorships engaged in commercial or professional activity — confirm the reach for your own structure with counsel. The Directions list twenty reportable incident types, including targeted scanning, phishing, website defacement, malicious code such as ransomware, data breaches and leaks, and unauthorised access to social-media accounts, and the report is due within six hours of noticing the incident. Decide in advance who files it and keep CERT-In’s reporting details somewhere everyone can find them; a six-hour clock is not the moment to look them up.

It helps, but it concentrates risk. The person who handles your GST, bank and e-way bill logins holds the keys to the accounts fraudsters want most, and a single compromised mailbox at a CA firm exposes every client at once. Give outside advisers their own logins rather than yours, turn on multi-factor login everywhere it exists, and review who has access every quarter, as CERT-In’s baseline recommends. Ask your IT vendor to show you — not tell you — that backups restore and that remote access is protected. Their good intentions are not evidence.