October is Cybersecurity Awareness Month. EthicsComputer has registered as an official Champion of the campaign every year since 2023: 2023, 2024, 2025 and again in 2026. We were also a Champion of Data Privacy Week in 2023, 2024 and 2026.
This post explains what the campaign is, what being a Champion means (and what it does not), and shares the security checklist we go through with our clients and our own team.
Quick answer: Cybersecurity Awareness Month is a global campaign held every October since 2004, led by the National Cybersecurity Alliance (NCA), a non-profit, with public- and private-sector partners. Organisations that register as Champions commit to promoting safer online habits among their staff, customers and community. EthicsComputer has been a Champion every year from 2023 to 2026.
What is Cybersecurity Awareness Month?
The idea is simple: most everyday attacks succeed because of a few weak habits, not because of advanced hacking. In recent years the campaign has focused on four habits that anyone can adopt:
- Use strong, unique passwords and a password manager to keep track of them.
- Turn on multi-factor authentication (MFA) wherever it is offered.
- Recognise and report phishing: suspicious emails, SMS, WhatsApp messages and calls.
- Update software on phones, computers, routers and websites as soon as updates are available.
What does being a Champion mean?
A Champion is an organisation that registers with the National Cybersecurity Alliance and commits to spreading the campaign's message. Registration is free and open to organisations around the world.
To be clear about what it is not: a Champion badge is not a certification, an audit or an endorsement of our services. Our security certification is separate: EthicsComputer is audited and certified to ISO/IEC 27001:2022 for information security, alongside ISO 9001:2015 and ISO 20000-1:2018. The Champion badge says something different: that we take our responsibility to raise awareness seriously, and this checklist is part of that.
Why this matters for Indian businesses
- CERT-In reporting: under CERT-In's directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within 6 hours of noticing them, and ICT system logs must be kept for 180 days.
- DPDP Act, 2023: any business that handles personal data must take reasonable security safeguards. Failing to do so can attract a penalty of up to ₹250 crore.
- Fraud reporting: online financial fraud can be reported on the national helpline 1930 or at cybercrime.gov.in. The faster you report, the better the chance of stopping the money.
A 10-point security checklist for your team
Most of these take less than a day and cost nothing. Start at the top.
| # | What to do | Why it matters |
|---|---|---|
| 1 | Turn on MFA for email, banking, payment-gateway dashboards, cloud accounts and every admin panel. | Stolen passwords stop being enough to get in. |
| 2 | Use a password manager; no shared or reused passwords. | One leaked password no longer opens every account. |
| 3 | Confirm any change of bank details or urgent payment request by calling a number you already know. | Stops invoice fraud and fake "boss" messages on WhatsApp or email. |
| 4 | Keep operating systems, browsers, plugins and routers updated; replace devices that no longer get updates. | Most attacks use known, already-fixed flaws. |
| 5 | Back up with the 3-2-1 rule (3 copies, 2 media, 1 offline) and test a restore every quarter. | Ransomware becomes an inconvenience instead of a shutdown. |
| 6 | Remove a leaving employee's access the same day; review admin accounts every quarter. | Old accounts are a common way in. |
| 7 | Get your website, apps and APIs tested (VAPT) at least once a year and after major changes. | Finds the gaps before attackers do. |
| 8 | Keep logs for 180 days and write down who reports an incident to CERT-In (incident@cert-in.org.in). | You meet the 6-hour rule instead of scrambling. |
| 9 | Collect only the customer data you need, restrict who can see it, and encrypt it. | Less data means less to lose and less DPDP risk. |
| 10 | Run a 30-minute awareness session every quarter and make it easy to report a mistake without blame. | People report clicks early when they are not afraid to. |
How we can help
If you want a second pair of eyes, EthicsComputer can test your website, apps and network (VAPT), help you with CERT-In compliance, and run security awareness training for your staff, for businesses anywhere in India and abroad.
Want a security check before the next incident?
Tell us what you run (website, app, office network) and we will suggest where to start.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 as a cybersecurity practice and leads its VAPT, software architecture and AI automation work. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
