Audit evidence that comes out of your systems, not out of screenshots taken the week before fieldwork.
A lot of security audit findings come back to identity. MFA skips the internal apps. Access never got reviewed. Accounts outlived the people who owned them. We map your controls to the rules you answer to and fix the technical gaps, then set things up so your IdP, IGA and SIEM produce the evidence themselves.
Identity providerMFA coverage by appIGA platformaccess review resultsPAM platformprivileged session logsSIEMmonitoring and alert history
02 · Evidence
GRC toolscheduled evidence exportsUnified control setone control · many frameworks
03 · Frameworks
NYDFS Part 500500.12 MFA · 500.13 inventoryPCI DSS 4.0.18.4.2 MFA into the CDECMMC and NIST SP 800-171self-assessment · SPRSNERC CIPCIP-004 · CIP-005 · CIP-015
SailPointOktaMicrosoft Entra IDCyberArk
in short·20-second read
Governance, risk and compliance (GRC) work ties security controls to the rules a business must follow and proves those controls operate.
Cohash maps controls to NYDFS Part 500, PCI DSS 4.0.1, HIPAA, NERC CIP and CMMC, closes technical gaps such as missing MFA or unreviewed access, and automates evidence from identity, PAM and logging systems. We engineer the controls and evidence, while legal interpretation stays with your counsel and assessors.
you probably need this if
Audit evidence is screenshots collected the week before fieldwork.
NYDFS now requires MFA on every system and your internal apps still skip it.
Each framework you answer to has its own spreadsheet and its own MFA project.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Governance, Risk & Compliance, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · governance, risk & compliance3 open
openAudit evidence is screenshots collected the week before fieldwork.
recurringNYDFS now requires MFA on every system and your internal apps still skip it.
blockedEach framework you answer to has its own spreadsheet and its own MFA project.
exposure
NYDFS Part 500PCI DSS 4.0.1HIPAA Security RuleNERC CIPCMMCUnified control mapping
startrehearsehandover
Scope
Gap assessment
Remediate
Automate evidence
we are here
ready to hand over
The CISO files against a measured list of authentication paths.
Every route into the CDE now hits MFA at the boundary, and the DBA shortcut is gone.
IdP and SIEM evidence now backs the score.
Applicability matrix by regulation and system
chapter 01 · where it hurts
Why teams reach out
Audit evidence is screenshots collected the week before fieldwork.
NYDFS now requires MFA on every system and your internal apps still skip it.
Each framework you answer to has its own spreadsheet and its own MFA project.
chapter 02 · what we change
How we solve it
NYDFS Part 500
PCI DSS 4.0.1
HIPAA Security Rule
NERC CIP
CMMC
Unified control mapping
chapter 03 · how it runs
Our approach
Scope
Gap assessment
Remediate
Automate evidence
chapter 04 · where you end up
What changes
The CISO files against a measured list of authentication paths.
Every route into the CDE now hits MFA at the boundary, and the DBA shortcut is gone.
IdP and SIEM evidence now backs the score.
Applicability matrix by regulation and system
what we do
Where we spend the hours
7 areas of work, each one done by an engineer who has run it in production.
Since 1 November 2025, covered entities must use MFA for anyone accessing their information systems unless the CISO approves equivalent controls in writing, and must keep a written asset inventory under section 500.13(a). We close the MFA gaps and build the inventory from systems you already run.
The future-dated requirements became mandatory on 31 March 2025, including requirement 8.4.2, MFA for all access into the cardholder data environment. Version 4.0.1 exempts accounts that use only phishing-resistant authentication. We trace every identity path into the CDE and fix the ones that fall short.
HHS proposed a major Security Rule update in January 2025, including MFA, encryption and a technology asset inventory. As of October 2026 it isn't final and the current rule still applies. We work to the current rule and adopt the proposal's controls where that's cheap now.
FERC approved CIP-015-1 in Order No. 907 on 26 June 2025, requiring internal network security monitoring for high-impact and some medium-impact BES Cyber Systems. We help utilities plan monitoring coverage alongside the access controls in CIP-004 and CIP-005.
The DFARS rule took effect on 10 November 2025 and started Phase 1 self-assessments. On 13 July 2026 the Department of War suspended Phase 2 third-party certification. Self-assessments, SPRS affirmations and NIST SP 800-171 duties under DFARS 252.204-7012 still apply.
One control set mapped across every framework you face, so a single MFA control answers NYDFS, PCI and CMMC wording instead of becoming three projects.
Access review results, MFA coverage, privileged session logs and configuration baselines exported on a schedule to your GRC tool, so evidence stays current all year.
capability 01 / 07in production
NYDFS Part 500
Since 1 November 2025, covered entities must use MFA for anyone accessing their information systems unless the CISO approves equivalent controls in writing, and must keep a written asset inventory under section 500.13(a). We close the MFA gaps and build the inventory from systems you already run.
The future-dated requirements became mandatory on 31 March 2025, including requirement 8.4.2, MFA for all access into the cardholder data environment. Version 4.0.1 exempts accounts that use only phishing-resistant authentication. We trace every identity path into the CDE and fix the ones that fall short.
HHS proposed a major Security Rule update in January 2025, including MFA, encryption and a technology asset inventory. As of October 2026 it isn't final and the current rule still applies. We work to the current rule and adopt the proposal's controls where that's cheap now.
FERC approved CIP-015-1 in Order No. 907 on 26 June 2025, requiring internal network security monitoring for high-impact and some medium-impact BES Cyber Systems. We help utilities plan monitoring coverage alongside the access controls in CIP-004 and CIP-005.
The DFARS rule took effect on 10 November 2025 and started Phase 1 self-assessments. On 13 July 2026 the Department of War suspended Phase 2 third-party certification. Self-assessments, SPRS affirmations and NIST SP 800-171 duties under DFARS 252.204-7012 still apply.
One control set mapped across every framework you face, so a single MFA control answers NYDFS, PCI and CMMC wording instead of becoming three projects.
Access review results, MFA coverage, privileged session logs and configuration baselines exported on a schedule to your GRC tool, so evidence stays current all year.
We pieced these together from Governance, Risk & Compliance situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
April NYDFS certification with internal apps still on passwords
composite · not a client story
Beforethe situation
Remote access and admin accounts at a covered entity require MFA. Internal web apps don't, and neither do local logins on Linux servers or a third-party claims portal. The CISO has to decide what the 15 April filing can honestly say.
What we dothe work
We inventory every authentication path from IdP, PAM and server logs and mark which ones meet Part 500's MFA rule. Internal apps get federated to the IdP. Server logins move behind PAM with MFA. Where the CISO approves an equivalent control, it is documented in writing.
Afterwhere you end up
The CISO files against a measured list of authentication paths. Any gap left has either a written CISO-approved control or a remediation date.
case file 02
PCI DSS 8.4.2 finding on a jump host without MFA
composite · not a client story
Beforethe situation
Admins get into the cardholder data environment through a Windows jump host. MFA is enforced at the VPN, not at the jump host, and DBAs also connect straight in from a management subnet. The QSA flagged requirement 8.4.2.
What we dothe work
We trace every identity path into the CDE from firewall rules and authentication logs. MFA goes at the CDE boundary, on the jump host through PAM or phishing-resistant authentication. The direct database route gets closed. Each path and its control is written down for the QSA.
Afterwhere you end up
Every route into the CDE now hits MFA at the boundary, and the DBA shortcut is gone. The QSA gets the list of paths with evidence for each one.
case file 03
SPRS score built from a self-assessment spreadsheet
composite · not a client story
Beforethe situation
A defense subcontractor posted its SPRS score off a self-assessment spreadsheet. Several NIST SP 800-171 controls were marked as met just because a policy existed. Two of them were MFA for network access and audit log review.
What we dothe work
We re-test the controls the score leans on most against system evidence, MFA and audit logging first. Identity and logging gaps get fixed before anything else. After that the system security plan and POA&M are updated so the affirmation matches what is actually running.
Afterwhere you end up
IdP and SIEM evidence now backs the score. The POA&M lists real gaps with dates, and the affirmation carries less False Claims Act exposure.
How audit evidence flows from your systems to each framework
The identity provider, IGA, PAM and SIEM export evidence to the GRC tool on a schedule. One unified control set maps that evidence to every framework you face, which is what your assessor reviews.
Unified control setone control · many frameworks → GRC tool · control mapping
03 · Frameworks
NYDFS Part 500500.12 MFA · 500.13 inventory
PCI DSS 4.0.18.4.2 MFA into the CDE
CMMC and NIST SP 800-171self-assessment · SPRS
NERC CIPCIP-004 · CIP-005 · CIP-015
Read the diagram as text
Identity provider → GRC tool: MFA report
IGA platform → GRC tool: review results
PAM platform → GRC tool: session logs
SIEM → GRC tool: monitoring
Unified control set → GRC tool: control mapping
GRC tool → NYDFS Part 500: evidence
GRC tool → PCI DSS 4.0.1: evidence
GRC tool → CMMC and NIST SP 800-171: evidence
GRC tool → NERC CIP: evidence
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Scope
Which regulations apply to which legal entities, systems and data.
step 02
Gap assessment
Technical controls tested against each requirement, with identity and logging examined closely.
step 03
Remediate
Gaps closed in priority order, starting with whatever a regulator or assessor tests next.
step 04
Automate evidence
Scheduled evidence collection set up and walked through with internal audit.
you keep
What you're left with
We write these for your Governance, Risk & Compliance setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
talent and delivery · governance, risk & compliance
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
GRC analyst
IT controls and audit specialist (SOX, HIPAA)
Identity governance engineer
Security policy writer
Security risk analyst
due diligence · governance, risk & compliance
Questions to ask any partner, including us.
Put these to anyone bidding on your Governance, Risk & Compliance work. The ones who've done it answer differently from the ones who've read about it.
Q1
Will you test our controls against system data, or just read the policy documents? Which ones?
Assessors sample system output. If your gap assessment only reads policies and never exports a configuration or a log, the assessor will find what it missed.
Q2
How will you keep your work separate from our assessor's?
A QSA or C3PAO can't assess controls they designed. Whoever builds the controls and evidence should be independent of whoever signs the report, and the engagement letter should say so.
Q3
How will one MFA control map to NYDFS, PCI DSS and CMMC wording?
Each framework words MFA its own way, with its own scope and exemptions. Map it as one control and you skip three projects and three sets of evidence that disagree.
Q4
Which evidence jobs will run on a schedule, and where will the results land?
Evidence gathered by hand the week before fieldwork is stale and hard to trust. Scheduled exports from the IdP, IGA and PAM into your GRC tool keep it current.
Q5
How do you track rules that are still moving, like the HIPAA Security Rule?
The HIPAA proposal still isn't final, and CMMC Phase 2 is on hold. Ask how each regulatory claim in the plan is dated and sourced, and what news would change it.
01Can you certify us or sign off on our compliance?
That's your assessor's job, whether a PCI QSA, a CMMC C3PAO or an external auditor, and they need to be independent of whoever built the controls. Our part is the engineering and the evidence. We work alongside the assessor during fieldwork to answer technical questions.
02What does the NYDFS MFA expansion mean in practice?
MFA for every individual accessing any information system, not only remote access and privileged accounts. Internal web apps, local server logins and third-party access are the common gaps. Entities that qualify for the limited exemption in 500.19(a) have a narrower scope. Annual certifications covering these requirements were first due on 15 April 2026.
03Is CMMC still worth preparing for after the Phase 2 suspension?
Yes. Level 1 and Level 2 self-assessments and SPRS reporting remain in force, and NIST SP 800-171 obligations come from DFARS 252.204-7012 whether or not CMMC moves forward. The suspension paused third-party certification, not the security requirements, and inaccurate affirmations still carry False Claims Act exposure.
04Should we wait for the HIPAA Security Rule to be finalized?
No. The current rule already requires risk analysis and access controls, and OCR enforces it today. Controls the proposal stresses, such as MFA and an asset inventory, are sound practice either way. We'd hold off rewriting policies to the draft's exact wording until a final rule is published.
05Do you cover TriZetto Facets access for healthcare payers?
Yes. We connect Facets roles and user provisioning to your IGA platform and include Facets in access reviews, so the evidence for who can see member and claims data comes from the same process as every other system.
related
Often paired with
Projects on Governance, Risk & Compliance usually end up touching one of these, so they're worth a look.
