Conducting cybersecurity audits and backing up sensitive data are best practices, but they happen intermittently.