Small and mid-sized businesses often assume they are too small to be a target. In reality, attackers rely on automation: they scan the internet for weak passwords, unpatched software and misconfigured cloud storage, and they send phishing emails to thousands of companies at once. A business with limited security is not overlooked — it is simply easier to compromise. Ransomware, business email compromise and payment-diversion fraud regularly hit companies of every size.
The good news is that most successful attacks exploit a short list of basic weaknesses. The Creensight team builds and operates web applications and cloud environments, and this checklist reflects the controls we apply for our own systems and recommend to clients. It is organised so you can work through it in priority order, even without a dedicated security team.
Key takeaways
- Multi-factor authentication, patching and tested backups prevent or limit the impact of most common attacks.
- Email is the main entry point: train staff to recognise phishing and verify payment changes by phone.
- Know what you have — an asset inventory of devices, accounts, software and data is the foundation of security.
- Apply least privilege: people and systems should only have the access they need.
- Prepare an incident response plan before you need it, including CERT-In reporting obligations in India.
- Websites and cloud accounts need the same care as office computers: updates, firewalls, logging and secure configuration.
Understand the most common threats
| Threat | How it typically works | Main defences |
|---|---|---|
| Phishing | Fake emails or messages trick staff into revealing passwords or opening malicious attachments | Awareness training, MFA, email filtering |
| Business email compromise | Attacker impersonates a supplier or executive and requests a payment or bank-detail change | Out-of-band verification, approval workflows, MFA |
| Ransomware | Malware encrypts files and systems; attackers demand payment and may leak data | Patching, endpoint protection, offline backups, least privilege |
| Credential stuffing | Leaked passwords from other sites are tried against your systems | MFA, unique passwords, login rate limits |
| Website attacks | Exploiting outdated plugins, weak admin passwords or insecure code | Updates, web application firewall, secure development |
| Cloud misconfiguration | Publicly exposed storage buckets, databases or admin panels | Configuration reviews, least privilege, monitoring |
| Insider and accidental leaks | Data sent to the wrong person or copied to personal devices | Access control, data classification, offboarding process |
1. Identity and access
Stolen or weak credentials are behind a large share of breaches. Securing identities is the single highest-impact step.
- Enable multi-factor authentication (MFA) on email, cloud consoles, accounting software, banking, website admin panels and remote access. Prefer authenticator apps or hardware keys over SMS where possible.
- Use a password manager for the whole team and require long, unique passwords.
- Remove shared accounts; every person gets their own login so actions are traceable.
- Apply least privilege: administrative rights only for those who need them, and separate admin accounts from daily-use accounts.
- Run an offboarding checklist the same day an employee or contractor leaves: disable accounts, revoke tokens, recover devices, rotate shared secrets.
- Review user access every quarter for critical systems.
2. Devices and software updates
- Keep an inventory of every laptop, desktop, phone and server used for work, with its owner and operating system.
- Turn on automatic updates for operating systems, browsers and office software; patch critical vulnerabilities promptly.
- Install reputable endpoint protection on all computers and keep it centrally monitored.
- Enable full-disk encryption on laptops and require screen locks.
- Replace devices and software that no longer receive security updates.
- Restrict installation of software to approved applications for most staff.
3. Email and phishing defence
- Configure SPF, DKIM and DMARC records for your domain to reduce spoofing of your email address.
- Use email filtering that scans links and attachments.
- Run short, regular phishing awareness training — realistic examples, not just an annual lecture.
- Make it easy and blame-free for staff to report suspicious messages.
- Label external emails so impersonation of internal staff is easier to spot.
Golden rule for finance teams: never change a supplier’s bank details or approve an urgent payment based on email alone. Call the requester on a phone number you already have on file — not one supplied in the email.
4. Backups and recovery
Backups are your last line of defence against ransomware, hardware failure and human error — but only if they work when you need them.
- Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy offsite or offline.
- Make at least one backup copy immutable or disconnected so ransomware cannot encrypt or delete it.
- Back up cloud services too — SaaS email, file storage and business applications.
- Test restores regularly; a backup you have never restored is an assumption, not a plan.
- Define how quickly each critical system must be restored and how much data loss is acceptable.
5. Website and application security
Your website is publicly reachable around the clock, which makes it a frequent target. For WordPress and other CMS-based sites:
- Keep the core, themes and plugins updated; remove anything unused.
- Use a web application firewall and login protection such as rate limiting and MFA for administrators.
- Use strong, unique admin usernames and passwords; change default database table prefixes and hide sensitive paths where appropriate.
- Serve everything over HTTPS and set security headers.
- Run regular malware and vulnerability scans.
- Take automatic daily backups stored outside the web server.
For custom applications, follow secure development practices: validate all input, use parameterised queries, store passwords with strong hashing, protect against common OWASP Top 10 risks, keep dependencies updated and review code before release. Our web development team builds these practices into every project.
6. Cloud security basics
- Protect the root or owner account with MFA and do not use it for daily tasks.
- Use roles and groups with least privilege rather than long-lived access keys.
- Block public access to storage buckets and databases unless explicitly required.
- Enable audit logging of administrative actions and alert on suspicious activity.
- Encrypt data at rest and in transit.
- Use infrastructure as code so configurations are reviewed and repeatable.
If you run on AWS, Google Cloud, Azure or DigitalOcean, our cloud solutions and DevOps service includes a security baseline review.
7. Data protection and compliance in India
Security and privacy obligations are increasing for Indian businesses.
- Digital Personal Data Protection Act, 2023: process personal data for lawful, stated purposes, obtain valid consent where required, implement reasonable security safeguards to prevent breaches, and notify the Data Protection Board and affected individuals of personal data breaches as prescribed.
- CERT-In directions (2022): report specified types of cybersecurity incidents to CERT-In within six hours of noticing them, synchronise system clocks and maintain logs for the required period.
- Information Technology Act, 2000: provides the broader legal framework, including obligations around reasonable security practices.
- Sector rules: payments, financial services and healthcare may have additional regulator requirements.
8. Incident response plan
When something goes wrong, a clear plan reduces damage, stress and cost. Your plan does not need to be long, but it should answer:
- Who is the incident lead, and who are the backups?
- How do staff report a suspected incident, at any hour?
- Which external contacts are needed — IT partner, cloud provider, legal counsel, insurer, bank?
- How do you contain an incident: isolate devices, disable accounts, block access?
- Who decides on and handles regulatory notifications, including CERT-In and data protection obligations?
- How will you communicate with customers, partners and employees?
- How will you restore systems from backups and verify they are clean?
- How will you review the incident afterwards and improve controls?
Run a short tabletop exercise once a year: walk through a realistic scenario such as ransomware or a compromised email account and check that everyone knows their role.
9. Suppliers, vendors and third-party access
Many incidents begin not inside your company but at a supplier: an IT contractor with remote access, a marketing agency with your website login, or a software vendor whose update is compromised. Every external party with access to your systems or data extends your attack surface, so manage them deliberately.
- Keep a list of every supplier with access to your systems, data or accounts, and what each can reach.
- Give suppliers individual accounts with MFA and only the permissions they need; never share your own credentials.
- Remove supplier access promptly when a project ends.
- Include security and confidentiality obligations, breach-notification duties and data-handling terms in contracts.
- Ask key software and cloud vendors how they secure your data and where it is stored.
The same principle applies to the tools your staff adopt on their own. Browser extensions, file-sharing apps and AI assistants can all move company data outside your control. Publish a short list of approved tools and a simple process for requesting new ones, so people have a safe way to be productive.
Prioritised checklist summary
| Priority | Control | Effort |
|---|---|---|
| 1 | MFA on email, cloud, banking and admin accounts | Low |
| 2 | Automatic updates on all devices and websites | Low |
| 3 | Offline or immutable backups with tested restores | Medium |
| 4 | Payment-change verification procedure | Low |
| 5 | Phishing awareness training | Low |
| 6 | Password manager and no shared accounts | Low |
| 7 | Endpoint protection and disk encryption | Medium |
| 8 | Website firewall, hardening and malware scanning | Medium |
| 9 | Cloud configuration and logging review | Medium |
| 10 | Data register and incident response plan | Medium |
Frequently asked questions
We are a small company. Do we really need all of this?
Start with the first five items in the summary table — they cost little and address the most common attacks. Add the rest progressively as your business and data grow.
Is antivirus enough?
No. Endpoint protection is important, but most attacks start with stolen credentials or phishing. MFA, updates, backups and staff awareness are equally essential.
How often should we review our security?
Review access and critical configurations quarterly, test backups at least quarterly, and run a broader security review annually or after major changes such as a cloud migration or new application launch.
Should we get cyber insurance?
Cyber insurance can help cover incident response and recovery costs, but insurers increasingly require basic controls such as MFA and backups before issuing a policy. Implement the checklist first, then compare policies carefully.
Strengthen your security with Creensight
Security is not a one-time project but a set of habits. By securing identities, keeping systems updated, protecting backups and preparing for incidents, small and mid-sized businesses can block most common attacks and recover quickly from the rest.
Creensight helps businesses secure their websites, applications and cloud environments, from hardening WordPress sites to designing secure cloud architectures. Contact us for a security review of your web and cloud setup, or explore our service packages.