NRF outlines data breach blueprint