If I was the CISO of a publicly traded company the protections I would implement would be: 

 . Role Access Control Panel 

My reasoning for this is that it would be easier to grant and cutoff access by role so that those who don’t need access, don’t have access. 

In this way, my company would not have an Edward Snowden like incident. 

 . Endpoint and Cloud Security 

My reasoning for this is that by protecting the cloud, the company, no matter what may happen, can never truly be sunk because they will always be able to start over instantly with the backup cloud. Security to the main infrastructure is also extremely important, but I choose to put equal attention on cloud protection also. A primary personal example that always motivates me to focus on cloud security is the incident with the Naval Data Center in New Orleans and Hurricane Katrina. 

 . Zero Trust Approach 

My reasoning for this is that if we always operate as if there is a spy then we will always be more cautious with our information and on our guard with our security