2) split cumulative funds into two wallets, a "hot" wallet and a "cold" wallet. keep the funds in the "hot" wallet to no more than for which total unintentional loss is tolerable. keep the private key to the "cold" wallet off any internet connected device except for the minimum duration required to transfer funds to the hot wallet.
3) print the recovery phrase for the cold wallet and store it in a physically secure location
4) if an ideally secure physical location is not possible, split risk across multiple "cold" wallets