The baseline: MFA (Multi-Factor Authentication) everywhere, no shared logins, separate admin accounts, least privilege on files, managed endpoint protection, automatic operating system and application patching, disk encryption, email filtering with SPF (Sender Policy Framework)/DKIM (DomainKeys Identified Mail)/DMARC, tested backups, and a written incident contact list. That list fits on one page and defeats the attacks small businesses actually experience.
Least privilege means users are not local administrators on their machines and do not hold blanket access to every file share. This one change stops a large share of malware from installing and stops a curious employee from reading payroll.
Password managers beat password policies. A business that adopts a shared password manager with per-user vaults kills the spreadsheet of credentials, the sticky note, and the reused password in one purchase. Pair it with passkeys where supported.
Security has to survive contact with the business. A control that stops the front desk from checking a patient in will be disabled by Friday. Design controls that fit the workflow, explain them in one sentence each, and revisit quarterly.