Nichole Windholz

Nichole Windholz is the Chief Information Security Officer of Onspring, appointed in November 2023.

Career path

Windholz joined Onspring in 2021 after spending 24 years at Cerner Corporation, where she held the role of senior security manager. She was promoted from within Onspring to the CISO role, taking on responsibility for the company's information security strategy and for protecting its data and systems. Earlier in her career she was Manager and Lead Technology Architect at a large health care company in Kansas City, a role she held for more than twenty years. During that period she also served as Vice President and Director of Education for the Information Systems Security Association's Kansas City chapter and was a founding member of Women in Security – Kansas City. In 2021 she joined the newly formed Mizzou Cybersecurity Industrial Advisory Board, which advises on cybersecurity research and educational curricula.

Remit at Onspring

As CISO, Windholz leads a team responsible for safeguarding Onspring's information assets and works with cross-functional teams to build security controls, risk management strategies and incident response plans. She has helped establish, and now serves on, Onspring's AI Governance Council, a cross-functional group focused on internal oversight and responsible development practices for AI adoption. She holds Certified Information Systems Security Professional and Certified Information Security Manager credentials, along with a Project Management Professional accreditation. Onspring also credits her with building a cybersecurity incident response center while leading global security initiatives for a Fortune 500 company earlier in her career.

Published commentary and recognition

In October 2025, Windholz was named winner of the CISO of the Year award in the CyberSecurity Breakthrough Awards program, which recognizes people driving progress in the information security industry. She has written for Onspring on how NIST's updated vulnerability prioritization model shifts the burden of risk triage. In a June 2026 interview with Help Net Security, she discussed the limits of automated governance, risk and compliance tools and continuous control monitoring. "A green-yellow-red view is a great, and in many cases, a highly necessary starting point, but it's not comprehensive," Windholz said. She added that, without context, a red indicator in such dashboards could mean a missing control, stale evidence, a missed attestation, or simply a threshold crossed on a low-impact asset.