A sweeping new study by Cybervadis and CESIN of 1,000 firms finds most have solid policies but weak proof.