With the growth of data processing, there has been a corresponding interest in legislation to satisfy the public's concern for privacy and computer crime. The need to develop a comprehensive data security approach, including physical security, contingency planning, data access controls, network security, data classification, and a policy statement is reviewed with a special emphasis on the need to establish an organizational security policy. This paper is based on a presentation at the 59th Conference of the Insurance Accounting and Statistical Association last June. (Publisher's abstract)