The first step in creating a complete data security plan is to know what types of data the company collects, where it is stored, and with whom and how it is shared. Next, the business should determine the potential risks to that data and whether the information resides in electronic or physical form (or both).