The next three are related to these three but more specific. Number 8 is a check that the preceding are working and number 9 is to keep a reasonably secure system that way. Failure to practice 10 makes other security related tasks more difficult. Regarding costs, firewalls, appropriate access permissions, turning off unneeded services and automatically detecting unexpected system changes are resource intensive up-front. Maintaining tight access permissions will also require ongoing administration.
Good passwords are very low cost.
Not allowing Internet access to shared file systems and forcing two level, remote administrative logins are trivial if good firewalls and access permissions are in place. Backups are resource intensive but may trade up front investment for ongoing costs. Periodic security updates require some ongoing resources. Not installing unneeded software is cost free going forward but attempting to remove unneeded software from existing system may be resource intensive and cause more harm than good. Web Site Design and Development.