Make proper DMZs. Control access to sensitive servers. Make proper backups. And test those backups. Anything less is reckless and should be punished.