Establish a budget for security protection: probably via the criticality and confidentiality of your data. If protection costs exceed value of your data, then don't spend more money on it. Consider all the forms of value though, the time it took to develop the data (hourly pay rate * number of days), the worth of your data to competitors, the reputation loss you would incur if your lose the data (future loss of income), the inconvenience to daily operations if you lose the data. And I must have omitted some.
This line of thinking encourages you to think as a business, and so you should. Everything in life has a cost or value. You have to justify your spending, in numbers.