If you and the people who work there don't know what to do, you most likely won't solve your problem by asking this generic question here or elsewhere. I'd sugg

If you and the people who work there don't know what to do, you most likely won't solve your problem by asking this generic question here or elsewhere. I'd suggest making an honest assessment of the value of your business and information, and depending on the numbers, considering the possibility of hiring a professional who can help you secure your systems.