CISOs need to define their risk tolerance, identify specific critical data, and make changes based on strategic business goals.