However much you’re willing to spend.
There are two sides to network security: guarding unwanted users from getting in, and preventing your data from getting out. To both of these ends, there is a direct correlation between the amount of money you invest and the level of security you’ll be able to achieve.
So how much is your data worth?
All data is valuable, of course. But take a look at the NSA—the government spends billions of dollars to protect their data, along with the cost of thousands of employees and contractors who are tasked with protecting it. If you compare this effort to that of your local accounting firm, there’s an obvious disparity.
As cut-throat as it may sound, your data is only worth what you’re willing to put into the resources to protect it.
The key is gauging the intersection of your budget and what you’re comfortable with. The NSA is clearly not comfortable with leaving any hint of vulnerability, and so they pay top dollar. The accounting firm down the road absolutely must be Sarbanes-Oxley compliant, but they’ll probably be comfortable without a retina scanner outside of their server room; their data just isn’t worth it.
Your best bet is to sit down with a professional. Talk through your priorities, see what your options are, and find the intersection that works for you.