As an SME you are a particularly attractive proposition for a cyber attack.  This is because cyber-criminals expect your IS Controls to be weak and so vulnerable.  While they may be interested in a ransom attack, it is equally likely that they are trying to use your IT System as a back door into the systems of your major public and private sector Customers and Suppliers.  That is, you are going to be their Trojan Horse!
As your Customers and Suppliers become more aware of IS, you can expect to be challenged more frequently on your information security arrangements and for these also to feature in SLAs.  Your best option is to get certified to ISO 27001 sooner rather than later.