Cybersecurity Guide for SMEs

Cybersecurity Assessment India —
DPDP Act, CERT-In and SME Security Gaps

Q: Why do Indian SMEs need a cybersecurity assessment?

Indian SMEs face three converging cybersecurity pressures in 2026: (1) DPDP Act 2023 — India's Digital Personal Data Protection Act requires businesses handling personal data to implement security safeguards; penalties for breaches reach ₹250 crore; (2) CERT-In mandates — all Indian entities must report cybersecurity incidents within 6 hours and maintain 180 days of ICT logs; (3) Supply chain pressure — large enterprise customers and export buyers increasingly require SME vendors to demonstrate cybersecurity standards (ISO 27001, SOC 2) before awarding contracts. A cybersecurity assessment identifies your gaps before regulators, customers, or attackers do.

Q: What does a cybersecurity assessment cost for Indian SMEs?

IBEAN cybersecurity assessment pricing: Free self-assessment (online, 20 minutes): ibean.co/assessments — gives a score across 6 domains with high-level gap identification. Level 1 Diagnostic (4–6 hours, virtual): ₹1.5–3 lakh — detailed gap analysis, risk-rated findings, 90-day remediation roadmap. Level 2 Technical Assessment (2–3 days, includes penetration test and cloud configuration review): ₹5–12 lakh. ISO 27001 Gap Assessment (prerequisite for certification): ₹3–8 lakh. For most Indian SMEs at ₹5–50Cr revenue, the Level 1 Diagnostic delivers the most value — it identifies the 5–8 critical vulnerabilities that carry the highest business risk and should be remediated first.

Q: What are CERT-In compliance requirements for Indian businesses?

CERT-In (Indian Computer Emergency Response Team) 2022 directions require all Indian businesses to: report cybersecurity incidents within 6 hours of discovery (types: data breach, ransomware, phishing, DDoS, website defacement); maintain ICT system logs for a minimum of 180 days (within India); sync system clocks with CERT-In or NIC time servers; enable logs on all cloud, server, and network infrastructure. Most Indian SMEs are non-compliant with the 6-hour reporting requirement because they have no incident response plan and no mechanism to detect incidents in real time. IBEAN's Cybersecurity Assessment includes a CERT-In compliance checklist and an incident response plan template.

Q: How often should an Indian SME conduct a cybersecurity assessment?

Recommended cybersecurity assessment frequency for Indian SMEs: Annual full assessment (all 6 domains) — minimum baseline. After any of: major technology change (new ERP, cloud migration, new SaaS platform), significant headcount change (>20% growth or layoff), data breach or near-miss incident, new regulatory requirement (DPDP Act implementation, sector-specific regulation), or new large customer/export contract with security requirements. Continuous: vulnerability scanning on internet-facing systems (monthly), log monitoring if a SIEM is in place, phishing simulation (quarterly). The biggest mistake: treating cybersecurity as a one-time compliance exercise rather than an ongoing operational function.

The DPDP Act 2023 (₹250Cr penalties), CERT-In 6-hour breach reporting, and supply chain security requirements are making cybersecurity non-optional for Indian SMEs. This guide covers the 6 security domains, the most common Indian SME vulnerabilities, and what a structured assessment involves.

₹250Cr

Max DPDP Act penalty for data breach

6 hours

CERT-In breach reporting window

Security domains assessed

Start Free Security Assessment Book a Cybersecurity Assessment

Need Expert Help?

Talk to an IBEAN specialist about applying these insights to your business — personalised advisory, not just information.

WhatsApp Us

Direct line to our advisory team

Fixed-fee diagnostic first. No commitment required.

6 Assessment Domains

What an SME Cybersecurity Assessment Covers

Access Control & Identity

Password policies, MFA enforcement, privileged access management, employee offboarding procedures

Risk: Compromised credentials are the #1 entry point for breaches — 80% of breaches involve weak or stolen passwords

Benchmark: MFA on all cloud accounts. Zero shared passwords. Offboarding checklist completed within 24 hours.

Endpoint Security

Antivirus/EDR coverage, patch management, BYOD policy, remote work device security

Risk: Unpatched endpoints and personal devices accessing business systems are the most common SME vulnerability

Benchmark: All devices enrolled in MDM. Patches applied within 7 days of release. BYOD policy with company data containerisation.

Cloud & SaaS Security

Cloud configuration audit (AWS/Azure/GCP), SaaS app inventory, data sharing permissions, shadow IT

Risk: Misconfigured S3 buckets and overpermissioned SaaS apps leak sensitive data without any attacker action required

Benchmark: Cloud security posture management (CSPM) tool in place. SaaS app inventory with owner assigned.

Data Protection & Backup

Data classification, encryption at rest and in transit, backup frequency, recovery time objective (RTO)

Risk: Ransomware encrypts business data; without verified backups, recovery requires paying the ransom

Benchmark: 3-2-1 backup rule (3 copies, 2 media types, 1 offsite). Monthly backup recovery test. RTO < 4 hours for critical systems.

DPDP Act 2023 Compliance

Personal data inventory, consent mechanisms, data principal rights process, data processor agreements

Risk: India's Digital Personal Data Protection Act 2023 — penalties up to ₹250 crore for data breaches involving personal data

Benchmark: Data inventory complete. Privacy policy updated for DPDP. Consent mechanism implemented for data collection.

Incident Response Readiness

Incident response plan, CERT-In 6-hour breach reporting compliance, contact list, tabletop exercise history

Risk: CERT-In mandates breach reporting within 6 hours — most Indian SMEs have no incident response plan and would miss this deadline

Benchmark: Documented IRP. CERT-In reporting process tested. Annual tabletop exercise conducted.

Most Common Gaps

6 Cybersecurity Vulnerabilities Most Common in Indian SMEs

Vulnerability	Prevalence	Consequence
No MFA on Microsoft 365 / Google Workspace	68% of Indian SMEs	Single compromised password = full email access, potential BEC (Business Email Compromise) fraud
Employees using personal Gmail/WhatsApp for business data	74% of Indian SMEs	Uncontrolled data leakage; company data persists on personal devices after employment ends
No regular patch management process	61% of Indian SMEs	Unpatched vulnerabilities exploited by automated attack tools; ransomware entry point
Cloud storage publicly accessible (misconfigured)	43% of SMEs using cloud	Customer PII, contracts, financial data exposed to anyone on the internet — DPDP Act liability
No documented incident response plan	81% of Indian SMEs	CERT-In non-compliance (6-hour reporting obligation); chaotic breach response that amplifies damage
Shared admin passwords for critical systems	55% of Indian SMEs	No audit trail; impossible to detect insider threat or attribute breach to specific access

Frequently Asked Questions

Cybersecurity Assessment — Common Questions

Frequently Asked Questions

Cybersecurity Assessment — Common Questions

7 Questions

Indian SMEs face three converging cybersecurity pressures in 2026: (1) DPDP Act 2023 — India's Digital Personal Data Protection Act requires businesses handling personal data to implement security safeguards; penalties for breaches reach ₹250 crore; (2) CERT-In mandates — all Indian entities must report cybersecurity incidents within 6 hours and maintain 180 days of ICT logs; (3) Supply chain pressure — large enterprise customers and export buyers increasingly require SME vendors to demonstrate cybersecurity standards (ISO 27001, SOC 2) before awarding contracts. A cybersecurity assessment identifies your gaps before regulators, customers, or attackers do.

IBEAN cybersecurity assessment pricing: Free self-assessment (online, 20 minutes): ibean.co/assessments — gives a score across 6 domains with high-level gap identification. Level 1 Diagnostic (4–6 hours, virtual): ₹1.5–3 lakh — detailed gap analysis, risk-rated findings, 90-day remediation roadmap. Level 2 Technical Assessment (2–3 days, includes penetration test and cloud configuration review): ₹5–12 lakh. ISO 27001 Gap Assessment (prerequisite for certification): ₹3–8 lakh. For most Indian SMEs at ₹5–50Cr revenue, the Level 1 Diagnostic delivers the most value — it identifies the 5–8 critical vulnerabilities that carry the highest business risk and should be remediated first.

CERT-In (Indian Computer Emergency Response Team) 2022 directions require all Indian businesses to: report cybersecurity incidents within 6 hours of discovery (types: data breach, ransomware, phishing, DDoS, website defacement); maintain ICT system logs for a minimum of 180 days (within India); sync system clocks with CERT-In or NIC time servers; enable logs on all cloud, server, and network infrastructure. Most Indian SMEs are non-compliant with the 6-hour reporting requirement because they have no incident response plan and no mechanism to detect incidents in real time. IBEAN's Cybersecurity Assessment includes a CERT-In compliance checklist and an incident response plan template.

Recommended cybersecurity assessment frequency for Indian SMEs: Annual full assessment (all 6 domains) — minimum baseline. After any of: major technology change (new ERP, cloud migration, new SaaS platform), significant headcount change (>20% growth or layoff), data breach or near-miss incident, new regulatory requirement (DPDP Act implementation, sector-specific regulation), or new large customer/export contract with security requirements. Continuous: vulnerability scanning on internet-facing systems (monthly), log monitoring if a SIEM is in place, phishing simulation (quarterly). The biggest mistake: treating cybersecurity as a one-time compliance exercise rather than an ongoing operational function.

IBEAN's SME Cybersecurity Assessment covers 6 domains: Access control and identity (MFA, privileged access, offboarding), endpoint security (device management, patch status, BYOD policy), cloud and SaaS security (configuration audit, shadow IT inventory), data protection and backup (encryption, backup verification, RTO), DPDP Act 2023 compliance (data inventory, consent mechanisms, data processor agreements), and incident response readiness (IRP documentation, CERT-In compliance, tabletop exercise). Output: a risk-rated finding report with specific remediation steps, prioritised by impact and effort, and a 90-day cybersecurity improvement roadmap.

The Digital Personal Data Protection Act 2023 (DPDP Act) is India's comprehensive data privacy law, applicable to all Indian businesses that process "personal data" of Indian residents — which includes virtually all SMEs (customer databases, employee records, lead lists). Key obligations for SMEs: implement "reasonable security safeguards" for personal data; obtain valid consent before collecting and processing personal data; appoint a data protection officer or point of contact for data principal requests; notify CERT-In and affected individuals within 72 hours of a data breach; enter into data processor agreements with third-party vendors handling personal data on your behalf. Penalties: up to ₹250 crore for a data breach due to failure to implement security safeguards. The DPDP Act rules are expected to be fully notified by mid-2026.

ISO 27001 is the international standard for Information Security Management Systems (ISMS). It is a certification that demonstrates systematic management of information security risk. Indian SMEs need ISO 27001 when: enterprise or government customers require it as a vendor qualification criterion (increasingly common for IT services, BFSI supply chain, healthcare vendors); you are seeking export contracts from EU or US customers who mandate security standards; you are planning a fundraise and investors expect security governance; or you process significant volumes of sensitive personal or financial data. ISO 27001 certification for an Indian SME typically costs ₹8–20 lakh (gap assessment + implementation + audit + certification) and takes 6–12 months. IBEAN provides ISO 27001 gap assessment as a pre-certification service.

help_outline

Additional questions? Contact the advisory team

Know Your Cybersecurity Gaps Before a Regulator or Attacker Does

IBEAN's Cybersecurity Assessment identifies your critical vulnerabilities, DPDP Act compliance gaps, and CERT-In readiness — with a 90-day remediation roadmap.

Start Free Security Assessment Book a Cybersecurity Assessment