State data privacy laws, regulations changing CISO priorities