your steps should be correct to the nature of the non-public data you maintain along with the hurt that might consequence from any compromise.