Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · boston

In Boston one scientist can hold a hospital badge, a lab login and a startup laptop at the same time.

Boston's big employers share people. A physician runs a trial with a biotech down the road, a postdoc moves from a hospital lab to a venture-backed startup, and a custody bank relies on outside vendors. Massachusetts asks each of them for a written security program that accounts for every one of those logins.

Talk to an engineer
work in boston7 services
3 local rules covered below
in short·20-second read

For Boston organizations we design and run identity governance, privileged access and data pipelines for life sciences companies, hospital systems and investment firms.

That covers access controls and audit evidence for lab and clinical systems, lifecycle rules for affiliated clinicians and researchers, and entitlement reviews on trading, fund accounting and custody platforms, all mapped to 201 CMR 17.00. Cohash works from Frisco, Texas, serves Boston remotely and flies in for workshops and launches.

We have no Boston office. Cohash runs Massachusetts engagements remotely from Frisco, Texas, and our consultants fly in for discovery workshops, design reviews and launch weeks.

terms on this page EntitlementdefinitionA specific permission or access right a person holds in a system, such as the ability to post journal entries in a finance app.explained in a field note →
Ask an engineer facts checked 2026-10-21 · 9 sources
rules
Massachusetts breach notice, M.G.L. c. 93H §3201 CMR 17.00, Standards for the Protection of Personal InformationFDA 21 CFR Part 11, electronic records and signatures
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
boston by the numbers

What's specific about Boston

Each figure comes from a public source, linked on the card.

01 2,733

Education and health services account for 623.4 thousand of the Boston-Cambridge-Newton metro's 2,733.8 thousand nonfarm jobs in September 2026 (preliminary), more than any other supersector in the BLS count.

source ↗ 02 3.1%

Massachusetts biopharma employment fell 3.1% in 2025 to 113,503 jobs, according to MassBio's 2026 Industry Snapshot, the first annual decline in the more than two decades the group has tracked it.

source ↗ 03 $3.45 billion

Massachusetts-headquartered biopharma companies raised $3.45 billion in venture capital in the first half of 2026, 25% of all US biopharma venture funding, the same MassBio snapshot reports.

source ↗ 04 85,000

Mass General Brigham reports 85,000 employees, which it says puts it ahead of every other private employer in Massachusetts, along with a $2.7 billion annual research budget.

source ↗ 05 $59,173 billion

State Street, headquartered in Boston, reported $59,173 billion in assets under custody and/or administration at 30 September 2026 in its third-quarter earnings release filed with the SEC.

source ↗
who and what

Who we work with in Boston, and the rules they work under

industries

  1. Biotech and pharma

    Lab instruments, electronic notebooks, LIMS and cloud genomics platforms each keep their own accounts, and contract staff change with every study. When a company shrinks, and the state's biopharma payrolls did in 2025, departed scientists can keep data access for months. We tie these systems to one identity source, revoke access the day someone leaves, and keep evidence quality teams can show an FDA inspector.

  2. Teaching hospitals and research

    A single person can be a clinician, a faculty member and a principal investigator, with a different account for each. Research data sets approved for one study tend to stay open after it closes. We build lifecycle rules around appointments and protocol end dates, and we put research warehouses behind role-based access tied to the approved study.

  3. Asset management and custody

    Order management, fund accounting, transfer agency and custody platforms carry thousands of entitlements, many granted for a single project and never removed. Segregation-of-duties conflicts hide in those leftovers. We run entitlement reviews that business owners can finish in an afternoon, vault the privileged accounts behind trading infrastructure, and govern the data feeds that now go into AI research tools.

regulations

  1. Massachusetts breach notice, M.G.L. c. 93H §3 ↗

    Owners or licensors notify the Attorney General, the Director of Consumer Affairs and Business Regulation and affected residents as soon as practicable and without unreasonable delay. The resident letter may not describe the nature of the breach or how many people were affected.

  2. 201 CMR 17.00, Standards for the Protection of Personal Information ↗

    Any business holding personal information about a Massachusetts resident needs a written information security program. Section 17.04 adds computer controls, among them secure user authentication, encryption of records that cross public networks or sit on laptops, and reasonable monitoring for unauthorized access.

  3. FDA 21 CFR Part 11, electronic records and signatures ↗

    Applies to biotech and pharma records kept electronically under FDA predicate rules. FDA's 2003 guidance narrows the scope and uses enforcement discretion on audit trails, but it still enforces limits on system access and the electronic signature controls.

services

Most requested in Boston

The services clients in Boston ask us for most.

you are hereBoston
01Does Massachusetts have a comprehensive consumer privacy law yet?

Not when we last checked. The Senate bill, S.2619, and the House's amended version, H.5479, went to a conference committee in June 2026, and no final bill had been signed. Chapter 93H and 201 CMR 17.00 still apply in the meantime, so the security program work does not wait on the outcome.

02What does a 201 CMR 17.00 security program need from our identity team?

Evidence. Regulators look for unique user IDs, controlled password and authentication handling, lockout after repeated failed logins, prompt removal of access for people who leave, and monitoring for unauthorized use. We document each control against the regulation's sections so the written program matches what the systems actually do.

03Our researchers hold appointments at a hospital and at our company. How do we handle their access?

Treat them as two relationships with separate end dates. We usually federate with the hospital's identity provider for sign-in, but keep entitlements in your own governance system, so a research collaboration can end without anyone waiting on the hospital's HR feed.

04Do our lab and quality systems need Part 11 audit trails?

FDA's guidance lets you decide audit trails by documented risk assessment, and says they fit well where users create, change or delete regulated records. We help quality teams write that assessment and then configure logging and access to match it. Your QA lead and regulatory counsel make the final call.

05Can you review entitlements on our trading and fund accounting platforms?

Yes. We extract roles from each platform, map them to job functions, flag segregation-of-duties conflicts and run the certification with business owners. Most of the effort goes into turning raw entitlement names into something a portfolio manager can actually read.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 9 sources linked last checked 2026-10-21 content fingerprint 543e9a5d
  1. 01BLS, Boston-Cambridge-Newton economy at a glancebls.gov ↗
  2. 02MassBio, 2026 Industry Snapshotmassbio.org ↗
  3. 03Mass General Brigham, facts and figuresmassgeneralbrigham.org ↗
  4. 04State Street, Q3 2026 earnings release (SEC exhibit 99.2)sec.gov ↗
  5. 05M.G.L. c. 93H §3malegislature.gov ↗
  6. 06201 CMR 17.04 (Cornell LII)law.cornell.edu ↗
  7. 07FDA, Part 11 scope and application guidancefda.gov ↗
  8. 08Massachusetts Legislature, S.2619 bill historymalegislature.gov ↗
  9. 09Massachusetts Legislature, H.5479malegislature.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it