in my humble opinion you should have a checklist of every customized file you have, as those are the ones that are prune to come back to SDW configured defaults after a hotfix or maintenance is applied in your system.
This best practice is not only true for the technical customization (such as server.xml, sasv9.conf, etc), but also to many functional/business customization. Some examples could be: themes, solution domains, etc etc.
I would suggest you to start creating such checklist document, it will help you a lot!
As @JuanS_OCS already shared best practice is to keep a list of all the modified files in the SAS configuration. Specially for Mid-Tier I take a backup copy of the configuration file after making the required custom changes so I can compare it when the file is overwritten by next hot-fix or rebuild/redeploy exercise. Mostly the changes are for files:
For Web Server most of the SAS configuration is under sas.conf. You can always create your own custom conf file and import it in the main file. This can help you to save hot-fix to override your custom config.