A sitemap.xml file and a robots.txt that doesn't accidentally block crawlers are the baseline. If Google can't crawl a page, nothing else about SEO matters for it.
The blue link text and grey snippet under it in search results come from your title tag and meta description — write them for the actual person searching, not stuffed with keywords.
A page that describes your business in general terms ranks worse than a page that directly answers a specific question someone is typing into Google — "how much does X cost in South Africa" beats "welcome to our company."
Google evaluates the mobile version of your site first, not desktop. A slow, non-responsive site is actively penalised, not just less pleasant to use.
For a business serving a specific area, a Google Business Profile and consistent name/address/phone details across the web do real, measurable work — often more than generic on-page tweaks.
Realistically 3–6 months for meaningful movement on competitive terms — anyone promising results in weeks is either targeting very low-competition terms or overselling.
No — Google Search Console and Google Business Profile are both free and cover the fundamentals most small businesses actually need.
Ongoing. Technical foundations are largely once-off, but content and authority-building compound over time and stall if you stop.