What steps would you take to protect a small organization from common cyber threats if you were helping set up basic security practices?

Based on the Cyber Security role, the general industry context, the beginner difficulty, and the focus on a broad, entry-level screening question.