Best practices for securing MikroTik router in small business setup?

Hardware MikroTik IoT hardware
2
  1. The default rules and settings protect 100% from outside.
  2. From inside, your best enemy is yourself.
  3. Ignoring internal devices, if the goal is to secure Router Access, reserve 1 phisical port for MGMT if some settings go wrong...
  4. No MGMT by wifi.
  5. For MGMT use two-factor autentication.
  6. No pptp or other buggy VPN for remote MGMT...
  7. Do not use admin, root, or other shi~~y usernames for the Rotuer configuration.
  8. Do not delete admin, just leave it enabled with complex password and NO RIGHTS profile.
  9. If you know how to work around something security, don't assume you're the only one who knows how.
  10. If you DON'T know how to work around something security, assume there's definitely someone who does.