This is the Praxium Labs view from real engagements with Nepali businesses on the ground. Most "cybersecurity advice" is overwhelming for Nepali SMEs. The list below is the realistic baseline — sub-NPR 100,000/year, achievable by any IT lead.
The 10-item baseline
- 1. Password manager (1Password, Bitwarden) for every team member
- 2. MFA on email, banking, AWS / cloud, code repos, social-media admin
- 3. Unique passwords for every account — generated by password manager
- 4. Secrets vault (AWS Secrets Manager, Doppler, or self-hosted Vault) for application secrets — never in
.envcommitted to a repo - 5. Endpoint security: OS updates automatic, antivirus on Windows endpoints, disk encryption (BitLocker / FileVault)
- 6. Email security: SPF, DKIM, DMARC published; reject spoofed mail at the gateway
- 7. Backups (see DR playbook) with immutable off-site copy
- 8. Patch management: Dependabot or Renovate on all repos; OS auto-updates scheduled
- 9. Logging and alerting for authentication events on critical systems
- 10. Incident-response runbook with named owners and contacts
The most common Nepali SME mistakes
- Sharing one Gmail / banking password among the team
- Storing AWS access keys in the code repo or in a Google Doc
- No MFA on the Facebook Business Manager (single takeover = ad budget gone)
- Manager-laptop unencrypted with everyone's personal data
- No off-site backups; "we have the database file on a USB stick"
- Domain control panel without MFA (DNS hijack is a takeover vector)
MFA specifics
- Authenticator apps (Google Authenticator, Microsoft Authenticator, 1Password) — strongly preferred over SMS
- Hardware keys (YubiKey) for admin accounts — phishing-resistant
- SMS: better than nothing but susceptible to SIM-swap. Avoid for admin / critical accounts
- Backup codes: generated and stored in your password manager so you do not lose access if the phone is lost
Email — the biggest attack surface
Business email compromise (BEC) is the single most-common Nepali-SME loss vector. The pattern: attacker compromises one mailbox (phished password), watches conversations, sends a "we changed our bank account, please pay here" email to a real client. Mitigations: MFA on every email account, DMARC quarantine policy, employee training on payment-change verification (always confirm by phone, never by email alone).
When to hire a real security professional
- Handling customer payment cards directly (PCI scope)
- Storing health records (Nepal Privacy Act sensitive category)
- Bank / BFI customer data at scale
- B2B selling into international enterprise contracts demanding SOC 2 / ISO 27001
- After a real incident
Free / cheap tools that cover the baseline
- Bitwarden Business: $5/user/mo password manager
- 1Password Business: $8/user/mo
- Have I Been Pwned API: alert when team emails appear in breaches
- Cloudflare Zero Trust free tier: 50 users, includes Access (SSO-style protection of internal apps)
- UFW / iptables: Linux firewall, free
- Fail2ban: blocks brute-force SSH attempts, free
- GitHub Advanced Security: built-in secret scanning on free repos
Frequently asked questions
Is Nepal a serious target for cyberattacks?
Yes — Nepali businesses are routinely targeted by financial fraud, ransomware, social-engineering, and DDoS. The attackers are mostly opportunistic / not Nepal-specific; the baseline above defends against the realistic threats. Targeted attacks against specific Nepali enterprises happen too, especially banks and government bodies.
Should I get cyber insurance in Nepal?
Available from several Nepali insurers in 2026. Reasonable for businesses above ~NPR 5 crore revenue. Read the exclusions carefully — many policies exclude social-engineering losses which are the most common claims.
How much should a Nepali SME spend on security annually?
5-10% of IT budget for SME; 15-25% for regulated businesses (banks, fintech, healthcare). Below this, baseline gaps are likely. Above this, diminishing returns unless you face specific elevated threats.
What does Nepal Rastra Bank require of regulated entities?
NRB's IT Guidelines for BFIs mandate periodic VA-PT (Vulnerability Assessment / Penetration Test), board-level IT-risk committee, documented BCP / DR, MFA on critical systems, and audit logs. Non-compliance results in regulatory penalties and supervisory escalation.
What's the single highest-leverage security investment?
Password manager + MFA universally adopted. It is unglamorous, sub-NPR 10,000/year, and prevents the vast majority of realistic attacks against Nepali SMEs.
Who can build this in Nepal?
Praxium Labs — Nepal's AI and automation consultancy, based in Lalitpur — designs and builds the systems described in this guide for Nepali businesses and for international teams hiring from Nepal. Start a project or see all services.