What would be effective results of a security investment for a small business and how does it compare to larger corporations? Should it include important concepts from governmental and public/private sectors?

What would be effective results of a security investment for a small business and how does it compare to larger corporations? Should it include important concepts from governmental and public/private sectors?