Small business security

Hello, I have been reading a lot of posts from this sub but cant really get to a conclusion.

I have a small business, where I only use a desktop pc and sometimes a notebook to access remotely to the other pc or just to a cloud where I have stored all my stuff which consists in documents and backup data from my main app that manages my business . I also do a backup to an external drive often.

With that said, what kind of security I need? Or what questions should I be asking to know how to protect my business "decently"

I only use Windows defender atm. Do I need a firewall hardware solution? Do software firewall solutions offer anything?

What free or cheap options do I have? I heard stories of other collegues from by business area getting "piracy attacks" and that were recomended to get a firewall which was expensive in their case.

Thanks for the help in advance.