What is a security roadmap for a 10-person Indian startup?
Key takeaways
- The first 90 days should deliver MFA, secrets management, 180-day log retention and a written incident plan, and cost almost nothing but engineer time.
- One external VAPT plus a retest in year one typically costs Rs 60,000 to Rs 1,50,000 for a 10-person startup with one product.
- The CERT-In 6-hour reporting requirement should be rehearsed as a tabletop once a year, with a timed run of the notification path.
- Quarterly access reviews and short-lived credentials remove more risk for a small team than most paid monitoring tools.
- Budget Rs 1,50,000 to Rs 3,00,000 a year for a 10-person startup, rising to Rs 6,00,000 once you handle payment or health data.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should the first 90 days deliver?
Four things, and the order matters because each one removes an entire class of incident. One: enforced MFA on every account that touches code, cloud, admin panels, customer data or money, including personal Gmail and the domain registrar. Two: every secret moved into a managed secrets store, with anything ever committed to the repository rotated. Three: logs shipped off-host with 180-day retention, and alerts on authentication failures and admin changes, which is the CERT-In baseline. Four: a one-page incident plan naming an owner, a deputy, an escalation list with mobile numbers, and the CERT-In and cybercrime.gov.in contacts. The whole set is configuration and documentation, not procurement, and it should be done before any new feature ships.
What should months four to six look like?
Hygiene and the things that quietly rot. A quarterly access review, which for a 10-person team takes about an hour per person and catches access that grew organically over the year. Dependency and base image patching on a schedule, with a named owner, since most breaches of small startups run through an unpatched public-facing service rather than a clever exploit. Backups that are off the production account, immutable, and restore-tested once, in writing, with the timestamp of the test. A DPDP Act 2023 privacy notice, a consent record for sign-up and marketing, and a data retention schedule. And a laptop hygiene policy: full-disk encryption, an MDM or at least an enrolment process, and remote wipe for the person who leaves. None of this needs a purchase, and all of it is asked about in diligence.
What should months seven to nine prove?
Assurance. One external VAPT of the product with authenticated roles, including a retest of the fixed findings inside the quote, and a report you can show an investor. Alongside it, a tabletop drill: pick a scenario such as a customer database exposed through a misconfigured bucket, and time the CERT-In 6-hour reporting path, from detection to notification. Then write the post-incident actions down while it is fresh, because a drill that produces no change is a meeting, not a drill. If you have a customer-facing security questionnaire open at that point, answer it with the test report rather than with prose. A 10-person team can do all of this inside two weeks of focused effort.
What should the first year end with, and what comes next?
End with three artefacts: a one-page security summary for the board or investors, a current third-party vendor register naming what data each vendor holds, and a written plan for the next hire, which is usually a security engineer or a senior engineer with security ownership at 20 to 30 per cent of their time. From there, the next twelve months depend on the business rather than on a calendar. If you take payment or health data, add continuous testing, a proper log pipeline and a DPDP readiness workstream. If you enter the enterprise market, add a customer security review process and a vendor risk programme. If you go international, add GDPR mapping. Write the roadmap in that conditional form, so it stays useful as the company changes.
| Quarter | Deliverables | Cost band |
|---|---|---|
| Q1 Foundations | MFA everywhere, secrets in a manager, 180-day logs, incident plan | Engineer time, Rs 0 - Rs 20,000 |
| Q2 Hygiene | Quarterly access reviews, patching, restore-tested backups, DPDP notice | Rs 20,000 - Rs 60,000 |
| Q3 Assurance | External VAPT with retest, timed CERT-In 6-hour tabletop drill | Rs 60,000 - Rs 1,50,000 |
| Q4 Process | Vendor register, team security training, plan for the first security hire | Rs 30,000 - Rs 90,000 |
What are the frequently asked questions?
Get a straight answer on this
Ask for our one-page quarterly roadmap template, so your team can run the four quarters without a security hire.
Send us the details See pricing