Insurance (III) Develop a threat model, assess the risks. Which systems? Which files? What networks? Be specific. Ensure that backups are performed regularly. No, really. I mean it. Backups are boring, but real security usually is. What do you need to back up?