I second this one. If you have personal data on people, make sure backups are encrypted. Also, if you are dealing with medical records of any type, make sure you comply with the law.