DLP software is installed across an enterprise, "it discovers and indexes where all your sensitive information is," says McMillan. "Then, based on the rules that you specify, in terms of where it can live, where it can go, how it has to be transmitted, what devices it can go on, etc., it basically watches what people are doing."

In this case, this nurse "was doing some legitimate research," he says. "She asked for some subset of patient information to support her research, which is all fine and good.

"The expectation was that she would be doing this research at the hospital," he adds. "But she, of course, like a lot of people, got into a time crunch and decided, 'I'll just send it home and work on it there.' She wasn't a bad person, she was just trying to get stuff done."

Fortunately, "the system noticed, and said, 'You can't send 9,000 patient records through Yahoo!,' and it stopped that transmission," says McMillan. "Even well-intentioned users will break the rules occasionally, not meaning to. Unless you have the right technological controls in your architecture to help protect against those things, you can have all the policies and procedures in the world, and it ain't gonna save you."

A 9,000-record breach is a big deal, after all – and could cost hundreds of thousands of dollars to settle.

"That incident alone, had it happened, would have (cost as much) as their DLP solution three times over, easily," says McMillan.

Even with an added layer of watchfulness thanks to DLP, Roszkowski still has plenty keeping her on her toes, of course. Like everywhere, mobile technology is a constant challenge. Encryption and PINs are used on every device that has any Fletcher Allen data, she says, but as far as a broader device management strategy, "We're looking at different approaches."

Sometimes life as a CISO can feel like "controlled chaos," she admits.

Even so, while "every day is different for me, every day has a purpose," says Roszkowski. "That's the biggest thing my team and I understand: It's all toward the same goal."