5) Encrypt data at rest (where possible) and look to take advantage of AMD's[0] or Intel's[1] coming features for runtime.

[0] - https://developer.amd.com/sev/

[1]- https://software.intel.com/en-us/sgx