First, a password manager, so every account has a different password. Compromises of businesses your size are almost never somebody attacking you specifically. They are automated attempts using credentials leaked from an unrelated service, tried against your bank, your email, and your hosting. Unique passwords make that attack fail entirely.
Second, two factor authentication on the accounts that matter: email first, then banking, your domain registrar, and anything that moves money. Email comes first because it is the reset mechanism for everything else, so whoever controls it eventually controls the rest. An authenticator app is the right default; a hardware key is better still for email and costs about thirty dollars.
Third, a backup you have actually tested by restoring something. Fourth, keeping devices, browsers, and any website software updated, because unpatched software is now the most common initial route into an organisation. Fifth, knowing how to recognise a phishing message, which is the one that requires attention rather than configuration.
Two things worth adding that are not strictly security. Emergency access, so somebody you designate can reach your accounts if you are unavailable for three weeks, which is a more likely event than a targeted attack. And an offboarding list, built when somebody starts rather than when they leave, recording every account they were given.
What is not on this list is antivirus beyond what your operating system includes, a VPN, or anything sold as a security suite for small business. Those address threats that are not what happens to you.
Write down what you did and where, because security work is invisible once complete and becomes impossible to audit. A short document listing which accounts have two factor enabled, where the backup runs, who holds emergency access, and when each was last checked converts a set of one time actions into something reviewable. Without it, the honest answer to whether your backup is still running is usually that nobody has looked in a year.
Whatever you implement, record what protects each critical account and check it annually, because security decays quietly. A two factor method tied to a phone you replaced, a backup that stopped running, or an account still accessible to somebody who left are all invisible until they matter. A short annual review of the same list is what turns a set of one time actions into something that remains true.