Electronic data stored on internet connected or other networked devices will be encrypted. Security patches will be installed on such devices promptly when available.
Non-encrypted backups and data stored on paper will be stored out of site in locked buildings or vehicles or on the data owner's own premeses.