“The CISO knows where all the bodies are buried and where all the evidence is,” said Donna Gallaher, a data privacy risk adviser.