How to prepare? First, if you don't have one already, establish a security policy for your organization. This is a big undertaking that covers a lot of ground - you'll need to consult with a security expert, or at least a book. If you already have a policy, this would be a good time to review it, update it, and get your organization's head to approve it.
Look at your defense in depth - are you trusting a DLink router to keep your entire small business safe? Do you have an Intrusion Detection System, like snort, and are the rules up to date? Have you reviewed the security on each of your systems? Does the receptionist really need to have an administrator account on his or her PC? Are the PCs up to a current patch level? Do they have anti-virus software? Are they automatically updating? Make sure that the day-to-day mechanisms of security are working.
Look at your Incident Response Plans. Planning to be attacked may not seem to make much sense because every attack is different, but at least you'll have thought about who you would contact for assistance, how you would recover from damage, and how you would restore functionality.
Go through your Disaster Recovery plans. Ensure that if you plan to restore from a backup that you're actually making backups. Test the backups. Regular backups are the only defense against the increasing threat of ransomware. Update your emergency contact info for everyone involved.
Do you have a relationship with local or federal Law Enforcement? It may be a good time to check in with them, or at least introduce yourself. Ask who and how to contact them in case of an attack, and update your response procedures.
Check with your vendors and suppliers. Are they prepared for attacks? Will they continue to serve you if you or they are attacked, or will they drop you due to a lack of resources? How will you contact or use them in an emergency?
Do you have security audits done? Nobody likes them, but this might be a good time to run one. External opinions are valuable, because they aren't blinded by all the shiny good work you've done. Also, consider hiring a security team to penetration test your organization.