You could create a user account for you CEO on your domain, grant the user RRAS access and setup a VPN link from his laptop.
Give the right folders the right permissions (file and share!!! permissions) on you’re server (and map the shared folder at your CEO’s laptop).
The idea is that each time your CEO is connecting via VPN, the network share becomes available.
The username and password can be saved on his laptop so that he has to initiate the link.