Not only all the things you mention, but another way to protect sensitive data is that it be shared only on a need-to-know basis. How did 20-something Snowden get access to such highly-classified data?
“but another way to protect sensitive data is that it be shared only on a need-to-know basis. “
That no longer applies and hasn’t for years; it is supposed to, but it hasn’t. Data distribution has gone wild over the past 15 years. Everyone with access gets all the data they want. The NSA retired their long standing data security protocol about 10 years ago. The new protocols allow for unlimited access once clearance is established.