Company record
CVS Health CISO: Alan Rosa
The current SVP and Chief Information Security Officer (CISO) of CVS Health is Alan Rosa, per CVS Health LinkedIn post (official CVS Health account). CISO Tribune verified this on .
Career profile: Alan Rosa on CISO Spotlights ↗
What CVS Health tells the SEC
Its fiscal 2025 Form 10-K, filed February 10, 2026, carries an Item 1C cybersecurity disclosure that describes a Chief Information Security Officer reporting to the Chief Experience and Technology Officer, with oversight by the Audit Committee. Read the section verbatim or the filing on sec.gov. A filing describes governance as of its date, not today's seat.
Roster record last verified September 9, 2026 · Updated
Where CVS Health appears on the record (2)
Every page on CISO Tribune and its network that carries this company, 2 in all.
- SEC filing
- Form 10-K cybersecurity disclosure, fiscal 2025 · Item 1C, filed February 10, 2026
- Career profile
About CVS Health
CISO Tribune's Leadership Bench files CVS Health under Healthcare and North America. The SEC classifies it under standard industrial classification 5912, Retail-drug stores and proprietary stores, and EDGAR lists its ticker as CVS.
What CVS Health's 10-K says about security governance
CVS Health's fiscal 2025 Form 10-K, filed February 10, 2026, describes its cybersecurity governance in Item 1C. The lines below are that filing's own statements, each with the sentence it comes from.
Reporting line: the Chief Information Security Officer reports to the Chief Experience and Technology Officer.
“The CISO reports to the Company's Chief Experience and Technology Officer (the "CETO"), who reports directly to the Company's Chief Executive Officer.”
Board oversight: the Audit Committee.
“The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks to the Audit Committee.”
How often the board or committee hears about it: quarterly.
“The Company's CETO and CISO provide the Audit Committee with recurring briefings—at least on a bi-quarterly basis—and update the full Board annually on the Company's cybersecurity posture.”
Frameworks and standards the filing names: NIST SP 800-53, SOC 2 and PCI DSS.
Experience of the security leadership, as the filing states it:
“The current CETO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.”
Material incidents: the filing states none.
“Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2025, the scope and impact of any future direct or third-party cybersecurity incident cannot be predicted.”
Plain-English reading and full text of the filing · the filing on sec.gov
What Alan Rosa has said in public
CISO Tribune's Voices section carries 1 public post or talk by Alan Rosa. The most recent are listed with their dates.
On recognition for team contributions behind an award, LinkedIn, November 12, 2026.
Security chiefs at other Healthcare organizations
Other organizations CISO Tribune files under Healthcare with a named security chief on record: those in North America first, in alphabetical order from CVS Health onward.
Erlanger Health System: Dennis Leber, Chief Information Security Officer.
Evernorth Health Services: Adam Sealey, Chief Information Security Officer.
Greenway Health: Paul Ford, Chief Information Security Officer.
Guthrie Clinic: Mangoné Fall, Chief Information Security Officer.
Merck: Tim McKnight, Senior Vice President, IT Risk Management & Security and Chief Information Security Officer.
Novant Health: Srini Uppugonduri, Chief Information Security Officer.
Ohio State University Wexner Medical Center: Mike Farrow, Chief Information Security Officer.
Omnicell: Michael McNeil, Senior Vice President and Chief Information Security Officer.
Questions CISOs ask about CVS Health
- Who is the CISO of CVS Health?
- The current SVP and Chief Information Security Officer (CISO) of CVS Health is Alan Rosa, per CVS Health LinkedIn post (official CVS Health account).
- When did CISO Tribune verify this seat?
- CISO Tribune verified this seat on September 9, 2026 from CVS Health LinkedIn post (official CVS Health account), as part of its roster of named security leaders.
- Who are the security chiefs at other Healthcare organizations?
- On CISO Tribune's record they include Dennis Leber at Erlanger Health System, Adam Sealey at Evernorth Health Services, Paul Ford at Greenway Health and Mangoné Fall at Guthrie Clinic.
- Has Alan Rosa spoken or written publicly?
- CISO Tribune's Voices section carries 1 public post or talk by Alan Rosa, the most recent dated November 12, 2026.
- Who does the security chief of CVS Health report to?
- CVS Health's fiscal 2025 Form 10-K, filed February 10, 2026, says its Chief Information Security Officer reports to the Chief Experience and Technology Officer.
- Which board body oversees cybersecurity at CVS Health?
- CVS Health's fiscal 2025 Form 10-K places oversight of cybersecurity risk with the Audit Committee.
Related guides
CISO Reporting Structure, the Five Models and What the Filings Show
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
CISO News: Tracking Every Appointment and Departure in the Top Security Seat
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.