IT Security Procedures

Recently, internet and IT security company Sophos reported that "... 90% of work computers fail on basic security..."

That's really worrying, and led me to this thought:

What sort of policies and practices do you have in your workplace to make sure that your computers and networks are safe and secure?

There's plenty of advice "out there", I'm sure, possibly including model policies and procedures. But how much of a priority is it for those of us who are sole traders, or maybe employ 2 or 3 people?

I suspect it is an aspect of business practice that deserves much greater consideration. If anyone out there knows of companies or businesses in the UK that have good practices in this area, please respond and let me know. After all, we could all learn something really important.