Research Triangle labs, hospitals and state agencies all hold data that outlives the people who collected it.
In the Triangle a clinical dataset might start in a Durham lab, pass to a contract research organization in RTP and end up in a state public health report in Raleigh. Each stop adds accounts, service connections and copies. The identity work is keeping track of who can still open each copy years later.
- Identity & Access ManagementCybersecurity
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Identity Threat Detection & ResponseCybersecurity
- Data Governance & AccessData & Analytics
- AI Governance & SecurityAI & Machine Learning
- Customer Identity (CIAM)Cybersecurity
We work with Triangle life sciences companies, academic health systems and public agencies on identity, access and research data governance.
For labs and contract research organizations that means FDA Part 11 access controls and audit trails. For agencies it means meeting North Carolina's 24-hour incident reporting to NCDIT. Cohash is headquartered in Frisco, Texas, serves Raleigh–Durham remotely and travels in for workshops and launches.
Cohash has no office in the Triangle. Our team works from Frisco, Texas, runs Raleigh–Durham projects remotely and flies in for validation workshops, agency briefings and go-live.
- rules
- North Carolina breach notification, N.C.G.S. §75-65N.C.G.S. §143B-1379 and §143-800, public-sector incidentsFDA 21 CFR Part 11, electronic records and signaturesHIPAA Security Rule, 45 CFR Part 164 Subpart C
What's specific about Raleigh–Durham
Each figure comes from a public source, linked on the card.
Research Triangle Park covers 7,000 acres and lists more than 385 companies on site, and its foundation says more than 55,000 people come together there every day.
source ↗ 02Education and health services account for 82.2 thousand of the Durham-Chapel Hill metro's 360.3 thousand nonfarm jobs, and government for 71.3 thousand, in BLS data for September 2026 (preliminary).
source ↗ 03Professional and business services are the biggest supersector in the Raleigh-Cary metro at 155.4 thousand of 783.2 thousand nonfarm jobs, with government close behind at 111.8 thousand, BLS reports for September 2026 (preliminary).
source ↗ 04SAS, the analytics software company, is headquartered in Cary and reports customers in more than 150 countries.
source ↗ 05North Carolina bars state agencies and local governments, including the UNC system, from paying or even communicating with ransomware attackers, and directs them to consult NCDIT instead.
source ↗Who we work with in Raleigh–Durham, and the rules they work under
-
Pharma, biotech and contract research
Validated systems such as LIMS, EDC and quality management need unique user IDs, controlled password and token practices, and audit trails an FDA inspector can follow. We integrate those systems with central identity without breaking validation, and we document the change controls so QA signs off on the first pass.
-
Academic medicine and research hospitals
A physician-scientist can hold clinical, teaching and grant-funded research access at once, across a university and a health system with separate directories. We link those identities, scope research data access to approved protocols, and expire it when the study or appointment ends.
-
State agencies and local government
Raleigh agencies and Triangle counties have to report significant incidents fast and are barred from paying ransoms. Recovery then depends on clean backups and knowing which accounts the attacker used. We focus on privileged access, MFA everywhere it can go, and identity threat detection that answers the 24-hour question.
-
Software and analytics companies
Product teams ship to customers who now ask for SSO, SCIM provisioning and audit logs before they sign. We design customer-facing identity features and the internal access model for production and customer data, so sales stops losing deals to security questionnaires.
-
North Carolina breach notification, N.C.G.S. §75-65 ↗
Paper records count here, not only electronic ones, because the statute covers personal information in any form. Notices must include contact details for the FTC and the North Carolina Attorney General, and the Attorney General's Consumer Protection Division receives its own report.
-
N.C.G.S. §143B-1379 and §143-800, public-sector incidents ↗
State agencies give the State CIO full details of significant cybersecurity incidents within 24 hours of confirmation, and §143B-1379 extends reporting to counties and cities. Section 143-800 forbids state and local entities from paying ransoms.
-
FDA 21 CFR Part 11, electronic records and signatures ↗
Closed systems must limit access to authorized individuals, keep secure time-stamped audit trails, and control identification codes and passwords. Electronic signatures have to be unique to one person and never reassigned.
-
HIPAA Security Rule, 45 CFR Part 164 Subpart C ↗
Covered health systems and their business associates need unique user identification, emergency access procedures, audit controls and person or entity authentication for systems holding electronic PHI.
Most requested in Raleigh–Durham
The services clients in Raleigh–Durham ask us for most.
- CybersecurityIdentity & Access Management
- CybersecurityIdentity Governance & Administration
- CybersecurityPrivileged Access Management
- CybersecurityIdentity Threat Detection & Response
- Data & AnalyticsData Governance & Access
- AI & Machine LearningAI Governance & Security
- CybersecurityCustomer Identity (CIAM)
01Will connecting our validated LIMS to single sign-on trigger revalidation?
It triggers a change control, and how much testing follows depends on your risk assessment. We document the identity change, the affected requirements and the test evidence in the format your QA group already uses, which usually keeps the effort to targeted testing.
02We're a county IT department. What does North Carolina's incident reporting rule mean for us?
Section 143B-1379(c) requires local governments to report cybersecurity incidents to NCDIT, and state agencies work to a 24-hour clock. Either way you need to scope an incident fast, so the logs showing which accounts were used must already be collected and searchable. We set up that identity telemetry and the playbook steps in advance.
03Can researchers keep access to a dataset after they leave the university?
Only if someone sponsors them deliberately. We tie research access to an appointment or a data use agreement with an end date, so a departing researcher's access lapses unless a principal investigator renews it with a reason.
04Can you help us govern AI tools that touch clinical or trial data?
Yes. We inventory which AI services and agents can reach regulated data, give each a distinct identity with scoped permissions, and log their use so privacy and quality teams can review it like any other system.
More cities in North Carolina
cfbff519 - 01Research Triangle Parkrtp.org ↗
- 02BLS, Durham-Chapel Hill economy at a glancebls.gov ↗
- 03BLS, Raleigh-Cary economy at a glancebls.gov ↗
- 04SAS, company informationsas.com ↗
- 05N.C.G.S. §143-800ncleg.gov ↗
- 06N.C.G.S. §143B-1379ncleg.gov ↗
- 07N.C.G.S. §75-65ncleg.gov ↗
- 08eCFR, 21 CFR Part 11ecfr.gov ↗
- 09HHS, HIPAA Security Rulehhs.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it