Access control comes first
Least-privilege access and multi-factor authentication address a large share of common security incidents at relatively low implementation cost.
Patch on a schedule, not reactively
A defined patching cadence for systems and dependencies closes known vulnerabilities before they can be exploited.
Assume you will need backups
Ransomware and hardware failure both make backups a baseline requirement, not an optional extra.