The big gotcha that takes a lot of business owners by surprise is information security - or lack thereof. Many assume that a firewall and anti-virus are all that's needed to run a safe and secure business but that's simply not true. There are so many other issues such as the security vulnerabilities related to mobile devices (laptops, smartphones, external hard drives, USB storage devices, etc.), your Web/Internet-facing systems (marketing site, e-commerce application, file uploading/downloading capabilities, remote access, etc.), your server management (patching, system hardening, passwords, backups, etc.), and your overall IT operations including security policies that outline what's expected of everyone as well as your security plans that outline the steps to take in the event of a security breach or disaster.

Of course, all of this will be of limited value if you don't have your users and the entire management team on board with security and privacy and the general responsibility of minimizing business risks in this area. Beyond the essentials, you need to have someone (internal or an outside consultant) who's aware of all the compliance regulations affecting your business such as PCI DSS, GLBA, HIPAA and the HITECH Act, and all the state breach notification laws.

Whew, no one said running a small business was easy but this stuff can be done if you approach it in the right way and not go overboard with expensive - and often unnecessary - controls that the vendors will undoubtedly push on you.