Identify business data owners
2. Define a taxonomy of sensitive data elements
3. Assign compliance controls
4. Tracking gaps and breaches, no matter how small
5. Reporting back to the board