Yes, there is much consideration of what needs to be done.
If it goes direct democracy, everyone's minister of defence. Saves a lot of arguing.
First you look at what you have to defend. Currently a server in a datacenter in Germany. It's unlikely to be getting much more than that any time soon, and even should that appear it's likely to actually be in another countries borders so likely requiring what could be best described as "security" should it be intended this is a secure facility.
Anything beyond that would require divulgence of the nature and location of the facility to provide for scope. Precise policy should be defined on a per facility basis conforming to general guidelines which we should be able to easily crowdsource once we have collaborational tools.
As specific mention is defence of Earth initatives for increasing PHA detection rate and distance should compliment existing efforts to spot and track, whilst other efforts investigate into implimenting mitigation techniques.