Security with very low budget?

What suggestions would you make for schools and charities with very low budgets for cyber security? If they can’t afford an EDR tool or SIEM for example.

Also what things should a practitioner first be looking at when trying to solve the problem for such an organisation? Should first step be to create a CMDB?

Thanks

budget budgets charities cmdb cyber cyber security cybersecurity edr low organisation problem schools security siem things tool