Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · tampa

Tampa staffs the back offices of national banks and the contractors around Special Operations Command.

Large banks, insurers and payment firms run service, fraud and technology centers around Tampa Bay, while MacDill Air Force Base hosts US Special Operations Command. People move between those employers, and so do laptops, contractors and old accounts. The access problems tend to follow them.

Talk to an engineer
work in tampa7 services
4 local rules covered below
in short·20-second read

We help Tampa Bay financial services firms, defense contractors and health systems control who can reach which systems.

At operations and service centers that means identity governance and access reviews a bank examiner will accept. For contractors supporting MacDill commands it means access controls and evidence mapped to CMMC Level 2. Cohash is based in Frisco, Texas, works with Tampa organizations remotely and travels in for workshops and launches.

There is no Cohash office in Tampa. We work from our Frisco, Texas headquarters, run Tampa Bay projects remotely and come in person for kickoff workshops, assessor walkthroughs and go-live.

Ask an engineer facts checked 2026-10-21 · 11 sources
rules
Florida breach notification, Fla. Stat. §501.171Florida Digital Bill of RightsCMMC Program, 32 CFR Part 170, and DFARS ruleBank computer-security incident notification, 12 CFR Part 53
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
tampa by the numbers

What's specific about Tampa

Each figure comes from a public source, linked on the card.

01 1,557

Financial activities employ 142.2 thousand people in the Tampa-St. Petersburg-Clearwater metro and professional and business services 284.8 thousand, out of 1,557.7 thousand nonfarm jobs, per BLS for September 2026 (preliminary).

source ↗ 02 3,500

US Special Operations Command lists its headquarters at MacDill Air Force Base, with about 3,500 people at headquarters and nearly 70,000 across the whole command.

source ↗ 03 28%

Port Tampa Bay is the state's biggest cargo port by tonnage and land mass, the Florida Ports Council wrote in May 2025, and its container volume grew an average of 28% a year over the previous five years.

source ↗ 04 50,000

The University of South Florida describes USF Health as Tampa Bay's only academic medical center, run in partnership with Tampa General Hospital, and counted nearly 50,000 students in fall 2025.

source ↗
who and what

Who we work with in Tampa, and the rules they work under

industries

  1. Bank and insurer operations centers

    A service center with thousands of staff sees hires, transfers and exits every week. Someone moves from collections to fraud and keeps both sets of entitlements. We automate joiner, mover and leaver rules from the HR feed, flag segregation-of-duties conflicts before access is granted, and run certifications that managers can finish in an afternoon.

  2. Defense contractors supporting MacDill

    Firms handling controlled unclassified information for command customers need the NIST SP 800-171 access control and identification requirements working, with evidence. We build the CUI enclave identity design, put administrators behind privileged access management, and assemble the artifacts a CMMC Level 2 assessor will ask to see.

  3. Academic medicine and cancer research

    Research teams hold datasets long after a study closes, and clinicians often carry research, teaching and patient-care roles at once. We tie data access to protocol approvals and end dates, and keep clinical access separate from research warehouse roles so one review doesn't miss the other.

  4. Port terminals and freight

    Terminal operators run gate, crane and yard systems that vendors support remotely. The Coast Guard now expects MFA on remote OT access and least privilege for admin accounts. We put vendor sessions through a brokered, recorded path and give each operator a separate credential for critical systems.

regulations

  1. Florida breach notification, Fla. Stat. §501.171 ↗

    When 500 or more Floridians are affected, the Department of Legal Affairs hears about it within 30 days, and so do the individuals themselves. Good cause in writing can buy 15 more days for individual notice. Notices to over 1,000 people also go to the nationwide credit bureaus.

  2. Florida Digital Bill of Rights ↗

    Effective 1 July 2024, but its controller duties start at $1 billion in global revenue plus an advertising, voice assistant or app store test, and GLBA financial institutions are excluded outright. Most Tampa operations centers will find their obligations come from federal banking rules instead.

  3. CMMC Program, 32 CFR Part 170, and DFARS rule ↗

    The program rule took effect 16 December 2024 and the DFARS contract clause on 10 November 2025, which began Phase 1 self-assessments. Phase 2 was due a year later to add third-party Level 2 certification, but the Department of War suspended it on 13 July 2026 pending a review.

  4. Bank computer-security incident notification, 12 CFR Part 53 ↗

    OCC-supervised banks must tell their supervisory office about a notification incident no later than 36 hours after determining it occurred. The Federal Reserve and FDIC have matching rules, so a Tampa operations center's incident runbook needs that clock in it.

services

Most requested in Tampa

The services clients in Tampa ask us for most.

you are hereTampa
01We support a MacDill command and need CMMC Level 2. What can you take on?

The identity and access pieces, which cover a large share of the NIST SP 800-171 requirements. That includes MFA, privileged access, account lifecycle and audit logging inside the CUI boundary, plus the evidence for each. We are not a C3PAO and don't perform the certification assessment.

02Our operations center has thousands of staff and quarterly access reviews nobody trusts. Where would you start?

With the data feeding the review. Most bad certifications come from entitlements with no business description and managers who can't tell what they're approving. We clean up role names, drop dormant accounts first, and then shrink the review so each manager sees only meaningful decisions.

03Does the Florida Digital Bill of Rights matter to a bank operations center in Tampa?

Rarely. Florida excludes financial institutions and data subject to Title V of Gramm-Leach-Bliley from the whole part. Your obligations come from GLBA, your primary federal regulator, the 36-hour incident notice rule and section 501.171 if Floridians' data is breached.

04Can research data access expire automatically when a study ends?

Yes, if the end date lives somewhere a system can read, such as the IRB or protocol tracking tool. We pull that date into the access request, so warehouse roles lapse when the protocol closes unless someone renews them.

florida

More cities in Florida

All 82 cities
JacksonvilleFintech, health plans & freight MiamiCross-border banking & travel OrlandoTheme parks & simulation
sources 11 sources linked last checked 2026-10-21 content fingerprint 2240c7cd
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02BLS, Tampa-St. Petersburg-Clearwater economy at a glancebls.gov ↗
  3. 03US Special Operations Command, aboutsocom.mil ↗
  4. 04Florida Ports Council, 2025 seaport spotlight on Port Tampa Bayflaports.org ↗
  5. 05University of South Florida, about USFusf.edu ↗
  6. 06Fla. Stat. §501.171flsenate.gov ↗
  7. 07Florida Digital Bill of Rights, Fla. Stat. ch. 501 part Vflsenate.gov ↗
  8. 08Federal Register, CMMC program rule (October 2024)federalregister.gov ↗
  9. 09Federal Register, DFARS CMMC acquisition rule (September 2025)federalregister.gov ↗
  10. 10eCFR, 12 CFR Part 53ecfr.gov ↗
  11. 11eCFR, 33 CFR Part 101 Subpart F (maritime cybersecurity)ecfr.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it