CISOs rethink their data protection strategies