An enterprise needs to have an overall plan to protect PII and secure _________ sensitive data.
Since a company is made up of many people, it’s easy to make this mistake. When writing about a company or organization, the actual organization should always be referred to as an “it,” not a “they,” unless of course you’re talking about the actual people who work there. Simply put, people are “they,” and a thing is an “it.”
For example, if you’re saying “I like Microsoft. ___ a good company to work for”, then you’re referring to the company, so you need “It is”. If you say “I called Microsoft and ___ told me I need to reinstall Windows”, you are referring to people who work there, not the company itself, so “they” is needed.