The Ten-Minute Monday: A Weekly Cyber Routine for a Small Indian Business

⏱ 9 min read|Published 19 October 2026|By Dibyendu Choudhury

When I ask the owner of a small unit what protects the business from a cyber attack, the answer is usually a product: an antivirus, a firewall, a cloud backup somebody set up two years ago. Ask who checks that any of it still works, and the room goes quiet. Security that nobody looks at is not security. It is a hope with a licence fee attached.

This note is for the owner, the accountant and the one person who happens to be good with computers, in a business of five to fifty people. It does not need a security team or a large budget. It needs ten minutes on the same day every week, a short list, and a rule about what happens in the first hour if something goes wrong. I have taught enough owners and watched enough small firms lose money to say with confidence that the routine matters more than the tool.

Why small firms are the easy target

A criminal who wants money does not need to break into a large company. He needs a payment that can be redirected, an account that can be taken over, or a person who will click quickly. Small businesses offer all three in generous supply. The accounts clerk handles bank access and also reads email from strangers. The owner approves payments from a phone, often while travelling. The same password is used for the bank portal, the GST login and the family streaming account, because remembering twenty passwords is a real burden.

None of this is carelessness in the moral sense. It is the ordinary result of a busy business with no one whose job is to look after this. The answer is not fear. The answer is a small, repeatable habit that closes the most common doors before anyone tries them.

The Monday list

Pick Monday morning, or whichever day your week begins, and keep the slot fixed. The list below takes about ten minutes once you have done it twice. Print it and tick it, because a list on paper is harder to quietly skip than a plan in your head.

First, look at who has access. Open the admin page of your email, your accounting software and your bank portal, and read the list of users. If someone has left the company, remove them today. If a former intern still has a login to the shared drive, that is the kind of quiet gap that stays open for years. In most small firms the single largest category of avoidable risk is an account belonging to a person who is no longer there.

Second, check the recent sign-ins. Most business email systems show where and when each account last signed in. Scan for a login from a city or a country nobody travelled to, or at an hour when the office was shut. One strange entry is a reason to change that password at once and to look at whether any mail forwarding rule has been added, because attackers often set a silent forwarding rule so they can read your mail even after you change the password.

Third, confirm that your backup actually ran. Do not look at the green tick in the dashboard and assume. Once a month, open one real file from the backup and check that it opens. A backup you have never restored from is an assumption, and assumptions are what ransomware feeds on. Keep at least one copy that is not permanently connected to your computers, such as an external drive kept off the network or a cloud copy with versioning, so that a single infection cannot reach every copy at the same time.

Fourth, install what is waiting. Operating systems, browsers, accounting software and phones all announce updates, and the announcements are easy to dismiss. Many attacks use faults that were fixed months earlier, against machines whose owners never clicked the button. Ten minutes on Monday is enough to apply the pending updates on the two or three machines that matter most.

Fifth, read the last week's payment changes. Look at every new payee, every changed bank account number and every payment above your usual size. Ask whether each was confirmed by a second route. This is the habit that stops the most expensive small-business fraud, and I will return to it below.

The payment-change rule

The commonest costly cyber incident I see in small firms is not a dramatic break-in. It is an email, apparently from a regular supplier or even from the owner, saying that the bank details have changed and the next payment should go to the new account. The message is polite, the logo looks right, and the timing is sometimes uncomfortably accurate because the sender has been reading the real conversation.

The defence is one rule with no exceptions: any change to bank details is confirmed by a phone call to a number you already had, not a number in the email. Write the rule down and tell your suppliers about it, so a request that skips the call looks wrong to everyone. Make it also apply to the owner. If the person who signs the cheques cannot send an instruction that breaks the rule, nobody can impersonate that person into breaking it either.

A related habit protects the phone. Many of us approve payments from a banking app while walking, waiting or talking. Set transaction limits you can live with, turn on the alerts for every debit, and treat a message that says your account will be blocked unless you act right now as a warning sign in itself. Banks do not ask for your PIN or one-time password by message or call, and anyone who does is not your bank.

A worked example, a composite and not a real firm

Imagine a made-up printing unit with twelve staff. The accounts clerk receives an email that appears to come from the paper supplier, who has been trading with the unit for years. It says the supplier has moved banks and asks that the pending invoice of a few lakh rupees be paid to a new account. The unit's routine is to pay on the supplier's word, because the relationship is old.

In a unit without the Monday list, the payment goes out on Tuesday. The real supplier phones on Friday to ask why the invoice is unpaid, and by then the money has moved through two or three accounts. In a unit with the list, the Monday check of payment changes flags the new account number. The clerk phones the supplier on the number already in the files, learns that no change was made, and the attempt ends with a single phone call.

The difference between the two units is not skill or budget. It is a rule, a list and a slot in the week.

Passwords, without the lecture

Everyone has heard that passwords must be long and different for every site. The advice is correct and almost nobody follows it, because it asks too much of memory. Do two practical things instead. Use a password manager for the business accounts, so that each login can be unique without being memorised, and protect the manager itself with a long passphrase made of four or five unrelated words. Then switch on two-step verification for email, banking and accounting first, and for everything else as you get to it. Two-step verification through an authenticator app is safer than a code sent by text message, though either is far better than none.

If you do only one thing from this note beyond the Monday list, make it the two-step verification on the business email account. Email is the key to the house, because almost every other service lets you reset its password by sending a link to your inbox. Whoever controls the mailbox can take over everything behind it.

If something goes wrong: the first hour

Despite good habits, something will eventually slip through. What matters then is that the first hour is calm and ordered, because panic produces the second mistake. Write the following steps on the same sheet as the Monday list so that they are in front of you when you need them.

Disconnect first and investigate later. If a computer shows a ransom message or behaves strangely, unplug it from the network or switch off its wireless connection, but do not shut it down at once if you can avoid it, as that can erase useful evidence. Change the passwords of the affected accounts from a different, clean device. If money has left your account, call your bank immediately and ask them to freeze or recall the transaction, because speed is the one advantage you have. For online financial fraud in India, the national cybercrime helpline is 1930 and complaints can be filed on the cybercrime.gov.in portal, and the sooner a complaint is registered the better the chance that a transfer can be held.

Organisations in India are also expected to report certain cyber incidents to CERT-In, the national response team, within six hours of noticing them. If you are not sure whether your incident qualifies, report it anyway and ask. If customer data may have been exposed, keep a plain written record of what happened and when, because that record will matter later for your customers, your insurer and any regulator.

Then, a few days afterwards, sit down with your team and ask what the incident revealed. Did the Monday list catch it, or would it have, had it been followed? Add the one line that would have prevented it. That is how the list grows to fit your business and not someone else's.

A thought from the old books

The Gita describes the steady person as one who is established in disciplined action, who does the small necessary thing at the proper time without drama. I find this a good description of good security. Nothing about a locked door is exciting. A tick on a list on Monday morning is not a heroic act. Yet the businesses that survive an attack are almost always the ones that did a number of small unglamorous things before it, and not the ones that bought the largest product after it.

The routine also helps your people. When staff know that payment changes are always confirmed by phone, they stop worrying about being tricked by a convincing email, because the rule makes the decision for them. Security that removes anxiety from the team is more likely to be followed than security that adds to it.

Where to begin

You do not need to adopt all of this at once. This Monday, do three things: remove one dormant account, switch on two-step verification for the email that matters most, and adopt the phone-call rule for bank detail changes. Next Monday add the sign-in check and the backup test. Within a month the whole list will take ten minutes and will feel as ordinary as locking the shop at night.

If you would like more practical notes of this kind, you will find them on the blog index. If there is a particular risk in your own unit that you would like me to write about, tell me, and I will take it up in a future note.

---

Published 19 October 2026 · dibyenduchoudhury.com