Short answer:
For employees: background checks, DLP, and rock-solid audit logs. Make sure employees know that access to the customer material is audited and logged, and that unauthorized access is a fireable offense.
For external adversaries: a good information security program. This will include TVM, EDR, SIEM at a bare minimum. This need not be a commercial solution, but if going the open source route, remember that just because it isn't a financial investment doesn't mean it's not an investment to take seriously.
Also, keep in mind that the 'I' and the 'A' of the CIA triad are not to be ignored. You should have a good BCDR program with redundant backups and you should make sure you can recover from them too.
There's so much more to go into here than can reasonably fit into a single post, but I hope this is a good starting point.
