In Utah a bank's IT may be run by its commercial parent. Examiners can review that parent too.
Utah's Department of Financial Institutions supervises industrial banks from Salt Lake City, and their parents need not become bank holding companies. Examiners can review an affiliate that runs bank IT. Add a six-state hospital system and a state office testing healthcare AI, and the access questions get specific.
- Banking & Capital Markets PlatformsEnterprise Platforms
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Customer Identity (CIAM)Cybersecurity
- Secrets & Certificate LifecycleCybersecurity
- Healthcare Provider PlatformsEnterprise Platforms
- LLMOps & Model EvaluationAI & Machine Learning
- Data Governance & AccessData & Analytics
In Salt Lake City we work with banks, fintech and payments companies, health systems and the vendors that serve them.
The work covers workforce and privileged access, affiliate and third-party access to bank systems, customer identity, and governed data for analytics and AI. We map those controls to bank IT exams and to Utah's written-program defense. Cohash serves Salt Lake City remotely from Frisco, Texas, and travels in for workshops and launches.
Cohash doesn't have a Utah office. We're based in Frisco, Texas, run Salt Lake City projects remotely, and come out for discovery, design workshops and cutover weekends.
- rules
- Utah breach notification, Utah Code §13-44-202Utah Consumer Privacy Act, Utah Code Title 13, Chapter 61Utah Cybersecurity Affirmative Defense Act, Utah Code §78B-4-701 to -703
What's specific about Salt Lake City
Each figure comes from a public source, linked on the card.
Financial activities account for about 66,700 of the Salt Lake City-Murray metro's roughly 863,400 nonfarm jobs, per BLS data for September 2026 (preliminary).
source ↗ 02Utah's Department of Financial Institutions, based in Salt Lake City, examines industrial banks jointly with the FDIC, IT examinations included. It says technology service providers to those banks, affiliates among them, can face their own examinations.
source ↗ 03Parents of industrial banks are not required to become bank holding companies, the department explains, under an exemption Congress wrote into the Competitive Equality Banking Act of 1987.
source ↗ 04Intermountain Health, based in Salt Lake City, lists 34 hospitals and 400 clinics serving patients in Utah, Idaho, Nevada, Colorado, Montana and Wyoming.
source ↗ 05Utah's Office of Artificial Intelligence Policy, in Salt Lake City, runs a regulatory sandbox and has signed independent third-party evaluators to audit healthcare AI pilots by testing guardrails and inspecting decision logs.
source ↗Who we work with in Salt Lake City, and the rules they work under
-
Industrial banks and their commercial parents
An industrial bank owned by a commercial company may share directory, cloud tenancy and help desk with its parent. Examiners will ask who in the parent can touch bank systems and data. We separate bank entitlements from parent ones, put affiliate engineers behind approved, logged access, and produce access reviews the bank's own officers sign.
-
Fintech and payments platforms
Card programs, lending platforms and payment apps built around a Utah bank charter need customer identity that holds up to fraud and to the bank's compliance team. We design sign-up, step-up authentication and account recovery, and keep API keys between platform and bank under rotation with named owners.
-
Multi-state health systems
A system operating in six states has clinicians credentialed in several of them, traveling staff, and research teams with their own datasets. Identity governance needs to follow the medical staff office and research approvals as well as HR. We tie access to those sources and set up clinical data pipelines with role-based views.
-
Healthcare AI pilots
Utah's sandbox lets companies test healthcare AI under agreed conditions, with outside evaluators reading the decision logs. That requires logging that is complete and reviewable from day one. We build the evaluation sets, prompt and output logging, and access controls around model and patient data.
-
Utah breach notification, Utah Code §13-44-202 ↗
After a prompt investigation, notify affected Utah residents in the most expedient time possible without unreasonable delay if misuse for identity theft or fraud has occurred or is reasonably likely. At 500 or more residents, the Attorney General and the Utah Cyber Center must also be told. At 1,000 or more, add the nationwide consumer reporting agencies.
-
Utah Consumer Privacy Act, Utah Code Title 13, Chapter 61 ↗
Effective 31 December 2023. Covers controllers and processors with $25 million or more in annual revenue that process data of 100,000 or more Utah consumers a year, or of 25,000 or more while earning over half their revenue from selling data. GLBA financial institutions, HIPAA covered entities and nonprofits are exempt.
-
Utah Cybersecurity Affirmative Defense Act, Utah Code §78B-4-701 to -703 ↗
In effect since 5 May 2021. A business that keeps and reasonably follows a written cybersecurity program conforming to a recognized framework has an affirmative defense in Utah courts to claims that it failed to secure, respond to or give notice of a breach.
Most requested in Salt Lake City
The services clients in Salt Lake City ask us for most.
- Enterprise PlatformsBanking & Capital Markets Platforms
- CybersecurityIdentity Governance & Administration
- CybersecurityPrivileged Access Management
- CybersecurityCustomer Identity (CIAM)
- CybersecuritySecrets & Certificate Lifecycle
- Enterprise PlatformsHealthcare Provider Platforms
- AI & Machine LearningLLMOps & Model Evaluation
- Data & AnalyticsData Governance & Access
01Our parent company runs IT for our industrial bank. What will examiners want to see on access?
A clear answer to who outside the bank can reach bank systems and customer data, and why. That means an inventory of parent and affiliate accounts with bank access, approvals by bank management, periodic reviews, and logs for privileged sessions. We build that evidence set and the controls behind it.
02Does the Utah Consumer Privacy Act apply to us?
Check the exemptions first. Financial institutions governed by Gramm-Leach-Bliley, HIPAA covered entities and their business associates, and nonprofits are outside it. A fintech parent or a consumer app that partners with a bank may still be covered if it meets the revenue and consumer thresholds. Your counsel makes the call, and we can map where the personal data sits.
03How does Utah's affirmative defense change our security program?
It rewards a written program that reasonably conforms to a recognized framework and that you actually follow. So the work is documentation and proof. We map identity and access controls to the framework you have chosen and keep the records that show the controls ran before any breach.
04Our 500-resident breach notice goes to the Utah Cyber Center too. What do they need?
The statute names the Attorney General and the Utah Cyber Center at that threshold. Confirm the current submission format with counsel. Our part is the technical record of which accounts, systems and data were involved.
19ead2ce - 01BLS, Salt Lake City-Murray economy at a glancebls.gov ↗
- 02Utah Department of Financial Institutions, industrial banksdfi.utah.gov ↗
- 03Intermountain Health, about usintermountainhealthcare.org ↗
- 04Utah Office of Artificial Intelligence Policycommerce.utah.gov ↗
- 05Utah Code §13-44-202 (effective 1 May 2024)le.utah.gov ↗
- 06Utah Code Title 13, Chapter 61, Utah Consumer Privacy Actle.utah.gov ↗
- 07Utah Code Title 78B, Chapter 4, Part 7, Cybersecurity Affirmative Defense Actle.utah.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it