Start by separating what needs protection from what does not. Client contracts, anything containing personal information about customers or employees, financial records, and identity documents belong in restricted locations. Marketing material and general documents do not. Businesses that apply the same protection to everything end up with either inconvenient friction on ordinary work or, more commonly, sensitive files sitting alongside everything else because the distinction was never drawn.
Control access at the folder level and grant the minimum rather than the convenient amount. The common failure is a shared link with broad permissions, created for one purpose, that persists indefinitely and works for anybody who ever received it. Use named access rather than links where the material is sensitive, set expiry on links where you must use them, and review who has access to what on a schedule rather than only when somebody leaves.
Two factor authentication on the account holding the documents is not optional. Storage is protected by the credentials of whoever can reach it, and a password alone is a single point of failure for everything inside. This is the same argument as elsewhere and it applies with more force here, because the consequence is not inconvenience but disclosure of somebody else's information.
Understand your obligation to the people whose information you hold. If you store personal data about customers, and particularly anything sensitive such as health or financial details, you may be subject to notification requirements if it is exposed, and to industry specific rules depending on your sector. Knowing whether that applies to you is worth establishing before an incident rather than during one.
Then decide retention deliberately. Holding documents indefinitely because storage is cheap increases what is exposed if anything goes wrong, and some records have defined periods after which they should be destroyed rather than kept. A short policy naming what you keep, for how long, and what happens at the end costs an afternoon and is the part almost nobody writes.
Decide what happens if you are unavailable, because document access is one of the places a solo business fails silently. If everything is in an account only you can reach, a hospital stay becomes a business interruption rather than an inconvenience. Most services offer a mechanism for designating somebody who can request access after a waiting period, and setting it up takes minutes. It is the least interesting item on any security list and the one most likely to actually matter.