This is unfortunate. Small business do not have the resources of a larger enterprise to recover from a significant security incident. Many probably don't have the deep pockets to last through an incident that crimps their revenue stream.

I understand that if you're running a small business you have to spend time building your core operations and sustaining your cash flow. I've been there and the last thing a small business owner needs is to become a computer security pro on top of the other "extras", like keeping books, doing the marketing, and staying on top of legal issues. These are the things that get done after hours and on weekends. Add anymore to the list and the time starts to come out of sleep.

My advice is to outsource. Businesses use outside accountants and lawyers all the time. Find a good IT consultant if you are big enough, and if not look to outsource your IT operations as much as possible. Use free or low-cost office apps like Google Apps or Zoho to save money which you can use for security. Buy a PC security suite and put it on all your PCs and keep it up to date. Find a pay-by-the hour PC service that can setup encryption on your wireless network. These suggestions are far from perfect and it's not a complete list but its just a start. If nothing else they beat sticking your head in the sand.

Companies that succeed don't skimp on accounting and legal services. I think the same logic applies to computer security.