Too often, security and risk (S&R) leaders create data policies without a clear understanding of feasibility and purpose within their business because they themselves are in the dark about their data — from what data they have to where it resides. As a result, many policies are ineffective and can even hinder business processes. In today’s evolving data economy, data identity is the missing link that S&R leaders must define to create actionable policy. This report was designed to help S&R leaders develop effective policies using their Data Security And Control Framework as a guideline.