Fix the cybersecurity basics first: MFA, passwords, updates, backups, access control, staff training, and response planning for small businesses.