The Chief Information Security Officer (CISO) of a large financial institution is responsible for implementing the security controls to protect the confidentiality and integrity of the organization's

Firewalls and reverse proxies are network perimeter controls that regulate traffic flow but do not directly encrypt or ensure the integrity of data itself, making them secondary to encryption in protecting confidentiality and integrity.

A WAF and HTTPS protect web application traffic and encrypt data in transit over HTTP, but HTTPS alone does not address data at rest, and a WAF focuses on application-layer attack prevention rather than foundational data confidentiality and integrity.

Encryption of data in transit (via TLS/SSL) and data at rest (via AES or similar algorithms) directly addresses both confidentiality and integrity - the two specific security objectives named in the question. In a financial institution, sensitive data must be protected regardless of where it resides or travels, and encryption is the foundational control that satisfies both requirements at the data layer before any network-level controls are considered. NIST and financial regulatory frameworks (e.g., PCI-DSS, GLBA) consistently identify encryption as a primary control for protecting sensitive data.

A firewall combined with an IPS provides perimeter defense and intrusion detection/prevention, but these are detective and preventive network controls that do not directly encrypt or protect the confidentiality and integrity of the underlying data.