maybe cis could do something to the files and folders themselves to add the protection in case cis isn't running. i don't know what this would be or if it's even possible but just an idea
doubtfully- all programs that provide such "protection" are based on them being in memory and overriding all access attempts.
only once i saw a program with other mechanics: it modified actual files, pre-writing self-module in, os when accessed it will start.(creepy idea..)