Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · grand rapids

West Michigan makes office chairs, surgical devices and jet parts, often on the same industrial park road.

Plants around Grand Rapids run dealer portals for furniture, quality systems for FDA-regulated devices and controlled technical data for defense primes. Each brings its own outside users and its own audit. Most of our conversations here begin with a plant manager asking how many of those logins still belong to someone.

Talk to an engineer
work in grand rapids7 services
4 local rules covered below
in short·15-second read

Around Grand Rapids we work with contract manufacturers, office furniture companies, medical device makers, aerospace and defense suppliers and health plans.

The work covers plant floor and vendor remote access, CMMC-ready identity for defense work, software bill of materials and update signing for connected devices, and governed member data. Cohash is headquartered in Frisco, Texas, serves West Michigan remotely and travels in for workshops and launches.

There is no Cohash office in Michigan. We're based in Frisco, Texas, run West Michigan projects remotely and come to the plant or campus for kickoff workshops, enclave cutovers and go-live.

Ask an engineer facts checked 2026-10-21 · 11 sources
rules
Michigan breach notification, MCL 445.72CMMC in DFARSFD&C Act section 524B, cyber devicesMichigan insurer cybersecurity events, MCL 500.559
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
grand rapids by the numbers

What's specific about Grand Rapids

Each figure comes from a public source, linked on the card.

01 110,400

Manufacturing holds about 110,400 of the Grand Rapids-Wyoming metro's 605,100 nonfarm jobs, close to one in five, in BLS data for September 2026 (preliminary).

source ↗ 02 14,000

The Right Place, the region's economic development group, counts 160+ office furniture establishments, 225 suppliers and more than 14,000 furniture jobs in West Michigan, with Steelcase in Grand Rapids and MillerKnoll in Zeeland on its list.

source ↗ 03 20%

According to The Right Place, the region employs over 20% of Michigan's medical device professionals and has the highest concentration of device manufacturers in the state.

source ↗ 04 8,700

West Michigan has 389 aerospace and defense manufacturing establishments and 8,700+ aerospace jobs, The Right Place reports on its aerospace and defense page.

source ↗ 05 1.3 million

Priority Health, which lists a Grand Rapids address on East Beltline Avenue, describes itself as serving 1.3 million members across Michigan, with Medicare, Medicaid, individual and employer plans.

source ↗
who and what

Who we work with in Grand Rapids, and the rules they work under

industries

  1. Office furniture and contract manufacturing

    Furniture makers sell through dealer networks that log into configurators, pricing tools and order portals, and the dealers change staff often. We put dealer users on federated or customer identity with automatic expiry, and we separate dealer, installer and employee roles so a pricing sheet stays with the people meant to see it.

  2. Medical device manufacturing

    A connected device now ships with a software bill of materials and a plan for patching after launch. That puts code signing keys, build pipelines and field service accounts in scope. We set up signing key custody, service account ownership and access logging for the engineering and service teams.

  3. Aerospace and defense suppliers

    Shops making parts for defense primes hold controlled unclassified information next to commercial work, usually in one ERP. CMMC Level 2 expects MFA, least privilege and audit logging around that data. We scope the CUI enclave, tighten who can reach it and produce the access evidence an assessor will ask for.

  4. Health plans and hospital systems

    Plans covering Medicaid and Medicare members share claims and clinical data with providers across the state. We build the data pipelines and analyst access behind those exchanges, with role scoping per program and audit trails tied to each data request.

regulations

  1. Michigan breach notification, MCL 445.72 ↗

    Michigan requires notice to affected residents without unreasonable delay. A vendor that only maintains the data notifies the owner. Notice can be skipped if the breach is unlikely to cause substantial loss or injury, a call the statute expects to be made with ordinary prudence.

  2. CMMC in DFARS (48 CFR rule) ↗

    In force from 10 November 2025, with Phase 1 self-assessments on certain contracts. The Phase 2 certification step was suspended on 13 July 2026 pending a review. Offerors post a current CMMC status for each CMMC unique identifier in SPRS, so a Level 2 gap can cost an award.

  3. FD&C Act section 524B, cyber devices ↗

    Since 29 March 2023, a premarket submission for a cyber device must include a plan to monitor and address postmarket vulnerabilities, processes for updates and patches, and a software bill of materials covering commercial, open source and off-the-shelf components.

  4. Michigan insurer cybersecurity events, MCL 500.559 ↗

    A health plan or other insurance licensee in Michigan has 10 business days from determining a cybersecurity event occurred to notify the state insurance director. Events involving 250 or more Michigan consumers can trigger the duty.

services

Most requested in Grand Rapids

The services clients in Grand Rapids ask us for most.

you are hereGrand Rapids
01We make parts for a defense prime. What does CMMC change for us in 2026?

If your contracts involve controlled unclassified information, expect a Level 2 self-assessment requirement in new solicitations. Third-party assessments were due to follow, but Phase 2 was suspended on 13 July 2026 pending a review and no new date had been announced as of October 2026. The identity controls are where most shops fall short, especially shared machine accounts and missing MFA on remote access. We help you close those and document them. We are not a C3PAO and do not perform the assessment.

02Should our CUI live in a separate enclave or in our existing ERP?

That depends on how much of your work is defense. Shops where it is a minority often find a separate enclave cheaper to secure and assess. If defense work runs through every job, scoping the whole ERP may cost less in the end. We model both before you commit.

03Our device is going to FDA next year. What identity work is in scope for 524B?

The statute asks for a vulnerability plan, update processes and an SBOM. On our side that means custody of the keys that sign firmware and updates, controlled access to build systems, and logged access for field service staff who can push changes. Your regulatory team owns the submission.

04Can dealer staff use our furniture configurator without us managing their passwords?

Yes. Larger dealers can federate with their own identity provider, and smaller ones can use passwordless sign-in on a customer identity platform. Either way, accounts lapse when a dealer contract ends.

05Do you send people to Grand Rapids?

For workshops, site walk-throughs and cutovers, yes. Design and build work happens remotely from Frisco.

michigan

More cities in Michigan

All 82 cities
DetroitVehicles, lenders & Blues
sources 11 sources linked last checked 2026-10-21 content fingerprint 62be485f
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02BLS, Grand Rapids-Wyoming economy at a glancebls.gov ↗
  3. 03The Right Place, office furniture manufacturingrightplace.org ↗
  4. 04The Right Place, medical device manufacturingrightplace.org ↗
  5. 05The Right Place, aerospace and defenserightplace.org ↗
  6. 06Priority Health, about uspriorityhealth.com ↗
  7. 07Michigan Legislature, MCL 445.72legislature.mi.gov ↗
  8. 08Michigan Legislature, MCL 500.559legislature.mi.gov ↗
  9. 09Federal Register, DFARS CMMC final rule (10 September 2025)govinfo.gov ↗
  10. 1021 U.S.C. 360n-2 (Cornell LII)law.cornell.edu ↗
  11. 11FDA, cybersecurity in medical devicesfda.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it