FedRAMP, DISA IL4 and ISO 42001: how security authorizations are announced and governed

What the Cornerstone announcement says

On March 10, 2026, Cornerstone OnDemand published a press release on Business Wire about a federal authorization. The company's announcement says it has received Authority to Operate at Defense Information Systems Agency Impact Level 4.

The release places this step in a sequence. It says the authorization builds on a provisional authorization from the year before.

The release also states what the authorization changes for buyers. It says additional government organizations within the defense and intelligence communities can now access the product.

None of the documents supplied for this guide define what Impact Level 4 requires. Anything beyond the vendor's own description would have to come from DISA documentation, which is not part of this review. What the release does show is the order of events: a provisional status first, then a full Authority to Operate.

How the vendor frames it

The release carries a quote from Apurva Dhanwantri, Chief Information Security Officer at Cornerstone. He says the full authority reflects readiness to operate in demanding conditions.

The framing is typical of a vendor announcement. The CISO is the named spokesperson, and the claim is tied to a customer outcome: federal agencies gaining a foundation to modernize workforce development. The release also points readers to the company's Trust Center for more on its security and privacy commitments.

For a security leader reading such a release, the useful details are the status named (provisional or full), the impact level, and who can now buy. The release gives all three.

A second announcement: ISO 42001

Cornerstone's newsroom carries a separate announcement about an AI management standard. It says the Galaxy platform achieved ISO/IEC 42001 certification.

A note on dates: the page shows a January 6, 2026 headline date, while the dateline in the body text reads January 6, 2025. This guide cites both as they appear and does not resolve the difference.

The release also quotes an outside analyst, Stacey Harris of Sapient Insights Group. She says buyers increasingly expect AI governance.

This shows a second way vendors present assurance. The government authorization speaks to federal buyers. The ISO certification speaks to commercial HR technology buyers, and the release supports it with a third-party quote.

Who governs FedRAMP

A GSA news release dated May 14, 2024 describes a change in FedRAMP governance. Its subheading says a new body takes over from the earlier one.

The release names a legal basis and an appointing office. It says the Office of Management and Budget set up the board and chose its first members.

GSA's executive director for cloud strategy, Eric Mill, describes the board's role in the release. He says it will approve policy and bring federal agencies together.

The inaugural members listed in the release are agency executives. They include the Chief Information Security Officer of the Department of Homeland Security, Hemant Baidwan, and the GSA Chief Information Security Officer, Bo Berlas. The list also includes the Department of Defense's David McKeown, who calls FedRAMP a critical foundation for the Department of Defense's cloud authorization program. Several members hold CISO or CIO titles, which makes the board a place where security leaders from government help set program direction.

What the board is working on

The release lists the board's early priorities. The first is continuity with the old structure.

The release adds further focus areas. These include defining metrics for the program and working on authorizations with agencies.

The release also says the board will work with FedRAMP on continuous monitoring of FedRAMP-authorized cloud products and services. For a vendor, that means an authorization is described as something monitored after it is granted, not a one-time event.

The authorization paths and the advisory committee

GSA also published minutes of a July 20, 2023 public meeting of the Federal Secure Cloud Advisory Committee. In them, FedRAMP's acting director, Brian Conrad, briefed the committee on the authorization process. The minutes say he described two routes.

The minutes list his key takeaways on modernization.

The same meeting heard from Jim Reavis, CEO of the Cloud Security Alliance, on cloud security concerns raised by enterprise CISOs. The minutes say he covered expectations CISOs have of cloud service provider leadership. They also say he showed a mock authorization boundary.

The committee then set its priorities. The minutes record the topics members raised.

Members voted on three priorities to pursue at the same time: cloud service provider authorization improvements, continuous monitoring process improvements, and automation initiatives. The minutes report the result.

What the public comments show

The minutes also record two public comments. One asked the committee to treat budget and workforce as priorities so that the FedRAMP program office has the resources to carry out its mission. The other focused on defense contractors.

Taken together, the documents give three views of the same system. A vendor describes an authorization as a milestone that opens a market. The board release describes the governing structure and its early work. The committee minutes describe a program that its own leadership says needs redesigned authorization paths and more automation.

A reader comparing vendor claims with program documents should note the gap in what each source covers. The press releases describe outcomes and access. They do not describe the assessment itself, and the government documents supplied here do not describe the Impact Level 4 requirements either.