A system that can't be reconfigured or recovered because of a lost administrator password is likely to be just as useless as one brought down by a DOS attack and likely to take much longer to get back. Nothing of value comes for free and all of my suggestions will involve time and or expense. These suggestions emphasize the most security improvement for the least resources and try to avoid permanent increases in the number of ongoing manual administrative tasks. There's no pretense these are best practices or that more couldn't or shouldn't be done. The listed order is somewhat but not entirely in order of importance.
Backups are the foundation on which all other security rests.
Good passwords, firewalls and access permissions are the basics of securing systems. The next three are related to these three but more specific. Number 8 is a check that the preceding are working and number 9 is to keep a reasonably secure system that way. Failure to practice 10 makes other security related tasks more difficult. Regarding costs, firewalls, appropriate access permissions, turning off unneeded services and automatically detecting unexpected system changes are resource intensive up-front.