A CISO's primary obligation is to protect the business, but they can only do that if they are also protecting themselves.