NRF urges ‘holistic’ approach to data security