You raise some good points, but the original question was specific to startups, so I'm making the assumption that 90% of the business really lives on hosted ser

You raise some good points, but the original question was specific to startups, so I'm making the assumption that 90% of the business really lives on hosted servers or is backed up on hosted servers somewhere else, and everyone has the ability to work from home on weekends, etc... On the credit card front you can only report the loss if you know about it. Lacking property security, audit trails, and alerting mechanisms, most people never know when their site's been compromised. Vast numbers of data theft incidents occur through SQL injection, exposed data files, plain-text user data being e-mailed around, etc... And you'll never know about it. Having proper security and encryption processes, rules, etc... makes a BIG difference. I'd also argue that for you and your 6 co-workers having the building burn down is a bigger deal than the data loss. But for your 100,000 customers having to deal with potential CC fraud and identity theft issues, is a MUCH bigger deal. Many cases of identity theft and associated credit and collections issues take YEARS to fix, if ever, and cause a great deal of hardship in the mean time. Your business can be up and running quicker than that.