It would be impractical to list every single expectation here, but the TradeHill exchange sets themselves up for PCI compliance. I think being PCI compliant is a great set of standards to keep your data safe and secure.
PCI compliance is basically security standards setup by the PCI Security Standards Concil for merchants who accept credit cards, online or offline. They have 4 sets of levels of PCI compliance, which I believe TradeHill to abide to the first level (at the bottom).
Common sense comes into play when storing Bitcoins. Keep a small percentage of them online for immediate usage, when your hot storage gets empty, fill it back up with funds stored offline. Keep multiple secure backups of your wallet files, so a 'bitomat' doesn't happen.
I don't think there is anything to protect a staff member from rubber hose attacks, but limiting the access of your staff members so that the information is accessed on a need-to-know basis through someone like you would help prevent sensitive data leaking. If they're attacking you, then you're fucked.