1. Forget about it and assume the risk. That may be what you have done so far, and that is still an option. If you don't suffer a public breach, you don't yet have any compliance pressure, and your customers (or investors and lenders) aren't yet asking for proof of your security...then it's up to you to make the call. Cybersecurity is a business risk problem, not an IT problem. How much risk you are willing to take with your business is your call to make. But since that risk is increasing every day, let's assume that's a risk you are no longer willing to take.
2. Hire a cybersecurity consultant. A reputable cybersecurity consultant can definitely help you build a program that protects your data and complies with the regs and best practices. But you need to make sure that the consultant is a "generalist" that approaches cybersecurity and privacy strategically, i.e., from the top down. Many cybersecurity consultants specialize in limited areas such as risk assessments, vulnerability assessments, penetration testing, and forensics. These are all important components of a full cybersecurity program, but much more is not covered. Be sure to ask any consultant how many cybersecurity programs they have built and implemented. Just doing a risk assessment is not building a program. A risk assessment identifies the problems and gaps, but it fixes nothing. And as you will quickly discover, hiring a traditional cybersecurity consultant to build a full program will be a very expensive proposition.
3. Ask your IT provider to handle it for you. This may seem like an easy choice. They already have access to your IT infrastructure and likely offer some cybersecurity services. But they are NOT cybersecurity and privacy specialists. And odds are, they themselves do not have a professional cybersecurity and privacy program implemented for their own business. Before you choose this option ask to see their internal cybersecurity program. You need to be doing this anyway as part of your vendor cyber risk management program, so there is no wasted effort here. Does their program include training, policies, vendor risk management, patching and the rest of the parts of a robust cybersecurity program? Probably not. Therefore, they are another risk to your company since their unsecured systems are connected and talking to your systems.
4. Buy a TURNKEY cybersecurity and privacy program. Until just recently, this option did not even exist. CyberCecurity, LLC, a full-service cybersecurity and privacy company headquartered in Denver has been building and testing turnkey programs for two years, and they have just launched a new company called Turnkey Cybersecurity and Privacy Solutions, LLC (TCPS).

TCPS is the ONLY company that offers TURNKEY, affordable cybersecurity and privacy programs for small-to-medium sized businesses. These are pre-engineered, comprehensive cybersecurity and privacy packages designed to make building a program much easier with less time and brain-damage.