CISOs at healthcare, pharma and regulated-industry firms

What the documents show

Three documents bear on how organizations describe the CISO's role. Two are Cornerstone OnDemand press releases, one from January 6 and one from March 10, 2026. The third is a May 14, 2024 announcement from the U.S. General Services Administration (GSA) about a new FedRAMP governing board. None comes from a hospital or a drug maker. Cornerstone is a workforce software vendor, and its website names regulated industries among its customers. The site says, "Healthcare Improve workforce skills, compliance, and patient outcomes. Life sciences Reduce risk and ensure compliance."

The documents show the CISO in two settings. In the Cornerstone releases, the CISO speaks for the company on AI governance and on government security authorization. In the GSA announcement, CISOs and other senior officials sit on a body that governs federal cloud authorization.

The CISO as the voice of AI governance

The January 6 release announces that Cornerstone Galaxy achieved ISO/IEC 42001 certification. The company's announcement says responsible AI management and governance are a core priority.

The CISO is the named executive in the release. The quote is attributed to Apurva Dhanwantri, SVP, Chief Information Security Officer.

Dhanwantri says AI plays a critical role in the company's products. She describes the standard as a structured way to manage that AI, with clear policies, objectives and processes that protect customers and support long-term innovation.

The release frames the CISO's mandate as policy, objectives and process, set out in a certifiable management standard. It does not describe a technical task.

An outside analyst, Stacey Harris of Sapient Insights Group, says responsible AI governance is quickly becoming a prerequisite for HR technology buyers. She adds that in her group's research, more than a quarter of organizations cite data quality and governance as their top barrier to adopting AI. The release uses her comments to support the case for the certification the CISO is speaking about.

The CISO and government authorization

The March 10, 2026 release announces that Cornerstone received Authority to Operate at Defense Information Systems Agency (DISA) Impact Level 4. The company says it received this authorization.

Dhanwantri is again the quoted executive, this time as Chief Information Security Officer at Cornerstone. She says organizations around the world trust the company to operate at the highest levels of security and safety.

She describes the authorization as proof of readiness. In her words, achieving full DISA IL4 Authority reflects the company's readiness to perform within one of the most demanding security environments in the world. She also ties it to compliance and to what agencies receive, saying the company is meeting rigorous compliance standards while giving federal agencies a trusted foundation to modernize workforce development.

The release also states what the authorization lets customers do. Organizations can modernize employee and training platforms to meet stringent security, compliance and operational requirements within a highly secured and reliable environment.

In this release the CISO speaks for the company as the person answerable for meeting an outside authorization standard. The CISO's mandate is expressed as readiness and compliance, and a regulator's approval is the evidence offered.

CISOs inside the governing body

The GSA announcement shows the same role from the side that grants authorizations. GSA announced a new board to serve as the official governing body for the Federal Risk and Authorization Management Program (FedRAMP). The Office of Management and Budget established the board and appointed its inaugural members under the FY23 National Defense Authorization Act.

Several seats are held by security and technology officers. The list of inaugural members includes the Department of Homeland Security's Chief Information Security Officer. It also includes the Department of Defense's Senior Information Security Officer and Deputy Chief Information Officer for Cybersecurity. GSA's own Chief Information Security Officer, Bo Berlas, is a member too. His statement says he looks forward to working with fellow board members and stakeholders on opportunities to modernize the program.

The board also draws on other roles. Members include chief information officers from the Department of the Air Force and the Federal Deposit Insurance Corporation, a deputy CIO from the Department of Veterans Affairs, and a technical director from the Cybersecurity and Infrastructure Security Agency. Deputy Federal Chief Information Officer Drew Myklegard says the board intentionally comprises members from across government.

GSA lists the board's work. It is focused on defining metrics for the program and on engaging with agencies to perform joint-agency and single-agency authorizations. In this announcement, then, the CISO's mandate reaches past one organization. Security officers help set the rules and review the authorizations that vendors like Cornerstone must meet.

What the wording has in common

Across the three documents, the same few terms recur in the CISO's mandate:

• Standards and certification. The January 6 release centers on ISO/IEC 42001, and the March 10 release on DISA IL4.
• Compliance as the proof point. Both Cornerstone releases pair the CISO with compliance claims and with an outside body's approval.
• Customer trust. Dhanwantri's quotes refer to protecting customers and giving agencies a trusted foundation.
• Shared governance. The GSA announcement places security officers on a board alongside CIOs and other officials.

The documents do not give the CISO's reporting line, budget, or authority over incident response. The Cornerstone releases use the CISO title to attach a named executive to a certification or authorization, and the GSA announcement lists CISOs among the officials who govern one.