1. A computer implemented method for data security management comprising: receiving a security policy at a security module of a platform via an out-of-band communication channel not accessible by an operating system (“OS”) of the platform; managing the received security policy by the security module, including storing the received security policy in an isolated storage not directly accessible by the OS; the security module receiving a request for data of the platform from an application of the platform operating in a context of the OS; and the security module implementing the security policy, including in response to the received request, classifying the data to determine a data type, identifying that the security policy applies to the determined data type, and in response to the identifying, the security module storing an indication that the security policy is associated with the data to provide security controls for the data, wherein the storing the indication is performed independent of the OS.