Security and risk (S&R) pros can't expect to adequately protect customer, employee, and sensitive corporate data and IP if they don't know what data exists, where it resides, how valuable it is to the firm, and who can use it. In this report, we examine common pitfalls and help S&R pros rethink overly complex and haphazard legacy approaches to data discovery and classification. This is an update of a previously published report. Forrester reviews and revises it periodically for continued relevance and accuracy, most recently doing so to factor in new ideas, tools, and data.