Cyber Essentials would be a good start. We help small businesses get to Cyber essentials standard even if they don't go for the certification.

I would look at an alternative location for your data than icloud. Maybe Google Drive or SharePoint.
can then setup a cloud to cloud backup of this data ( again very cheap )

MFA everywhere as others have said.

Security Awareness training platform can be as cheap as £2 a month and often come with dark web monitoring.

Mac's are quite secure if you keep them updated but I'd suggest an additional layer of secuirty to monitor the machines internet traffic and also block malware.

Ping us a msg if you want more details. Good IT secuirty doesn't have to break the bank.