data security planning lessons at citibank