Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
industries · public sector

Clear FedRAMP, TX-RAMP and CJIS review on cloud and identity before the procurement clock runs out.

Agencies buy cloud services through authorization programs, share systems with law enforcement and run resident portals on fixed budgets. We help agencies, and the vendors who sell to them, design identity and data controls that fit the authorization each buyer requires.

Talk to an engineerThe rules that apply
industry / public-sector 5 rules in scope
01 · PEOPLE 02 · IDENTITY 03 · AGENCY SERVICES 04 · EVIDENCE Agency staff: employees · contractors Agency staff employees ·contractors Law enforcement users: officers · dispatch · courts Law enforcementusers officers · dispatch ·courts Residents: web · mobile Residents web · mobile Workforce identity: Entra ID · MFA · Conditional Access Workforce identity Entra ID · MFA ·Conditional Access Resident identity: one sign-in · passkeys Resident identity one sign-in · passkeys Case management: Dynamics 365 · Power Apps Case management Dynamics 365 · PowerApps CJI systems: RMS · CAD · state switch CJI systems RMS · CAD · stateswitch Resident portal: Salesforce Experience Cloud Resident portal Salesforce ExperienceCloud Authorization package: FedRAMP · GovRAMP · TX-RAMP Authorizationpackage FedRAMP · GovRAMP ·TX-RAMP CJIS audit evidence: MFA · audit logs · addendum CJIS audit evidence MFA · audit logs ·addendum
Microsoft Entra IDOktaMicrosoft Dynamics 365Microsoft Power Platform
in short·20-second read

Public sector organizations need cloud services with the right authorization.

Identity has to satisfy CJIS and state security policy, and residents have to be able to sign in. We design workforce and resident identity on Entra ID and Okta and build case management on Salesforce, Dynamics 365 and Power Platform. We map those controls to FedRAMP, GovRAMP, TX-RAMP and CJIS and help vendors prepare evidence for each review.

you probably need this if
  • The new solicitation asks for TX-RAMP Level 2, and all your product has is a provisional status.
  • Patrol car laptops reach the records system on a password alone.
  • Residents create a new account for each permit, license and utility service.
Ask an engineer facts checked 2026-10-20 · 8 sources
how it runs
  1. 01Map each rule to its systems
  2. 02Measure who can reach regulated data
  3. 03Fix and automate the controls
  4. 04Produce evidence auditors can sample
rules
FedRAMP and FedRAMP 20xGovRAMPTX-RAMPFBI CJIS Security PolicyCMMC
platforms
proof
6 case studies on this
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
regulations

The rules your access program answers to

Summaries for orientation, not legal advice. Each links to the primary text.

FedRAMP and FedRAMP 20x

Federal authorization for cloud services agencies use, and it's changing. FedRAMP 20x is in its third phase and has opened submissions for Low and Moderate classes. New Rev5 certifications are due to stop on 11 June 2027, though FedRAMP calls future dates estimates that may shift.

source ↗

GovRAMP (formerly StateRAMP)

On 14 February 2025 StateRAMP became GovRAMP, at least in name. Any status you already had stayed put. If a state or local buyer participates, it vets cloud vendors using GovRAMP's verified statuses, and those rest on NIST SP 800-53.

source ↗

TX-RAMP (Texas Government Code 2054.0593)

No TX-RAMP, no Texas state agency contract, new or renewed. Program Manual 4.0 has been in effect since 12 February 2026. Vendors can certify through a DIR assessment, or use a FedRAMP or GovRAMP status they already hold. A qualifying third-party audit opens a fast-track review.

source ↗

FBI CJIS Security Policy

Applies to agencies and vendors that access criminal justice information. Version 6.1 was published on 25 June 2026 and requires MFA for access to CJI. Your CJIS Systems Agency decides which version your next audit uses, and it's worth asking before design starts.

source ↗

CMMC (32 CFR Part 170)

Applies to defense contractors handling federal contract information or CUI, including universities and public entities with DoD contracts. Self-assessments and SPRS affirmations continue. The Department of War suspended Phase 2 third-party assessment requirements on 13 July 2026 pending a task force review.

source ↗
from rule to evidence

How a regulation turns into proof.

For public sector, each rule below lands as a control, the control runs on a platform, and the platform leaves a record an auditor can read.

  1. 01

    Rules you answer to

    FedRAMP and FedRAMP 20xGovRAMPTX-RAMPFBI CJIS Security PolicyCMMC
  2. 02

    Controls we build

    Authorization readiness for vendorsWorkforce identity consolidationResident identityCase management and service portalsGoverned data sharing between agencies
  3. 03

    Platforms that enforce them

  4. 04

    Evidence your auditors read

    Access review records Joiner, mover and leaver logs Privileged session records Change and approval history Control-to-rule mapping
the story · public sector access program

From the first call to a setup your own team can run.

Here's what usually prompts a call about your public sector access program, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • The new solicitation asks for TX-RAMP Level 2, and all your product has is a provisional status.
    • Patrol car laptops reach the records system on a password alone.
    • Residents create a new account for each permit, license and utility service.
  2. chapter 02 · what we change

    How we solve it

    • Authorization readiness for vendors
    • Workforce identity consolidation
    • Resident identity
    • Case management and service portals
    • Governed data sharing between agencies
  3. chapter 03 · how it runs

    Our approach

    • Map each rule to the systems it touches
    • Measure who can reach regulated data today
    • Fix access and automate the controls
    • Produce evidence auditors can sample
  4. chapter 04 · where you end up

    What changes

    • This time the submission goes in with the boundary drawn and the MFA, admin access and log retention evidence ready, because that's where findings usually land.
    • Officers sign in to the RMS with MFA from the car, and every record opened is logged to a named officer.
challenges and answers

Where it usually goes wrong, and what we do about it

where it goes wrong
  1. 01

    Authorization gates every cloud purchase

    A product without the right FedRAMP, GovRAMP or TX-RAMP status can't be bought, however good it is. Vendors often discover the gap after a solicitation is already out.

  2. 02

    Criminal justice data in shared systems

    Records management, dispatch and court systems mix CJI with ordinary case data. That pulls every user and vendor who can reach them under the CJIS Security Policy, mobile devices included.

  3. 03

    Residents with a different login for every service

    Each department runs its own portal, with separate accounts for permits, benefits, utilities and courts. Passwords get forgotten, the help desk gets the call, and applications are abandoned halfway through.

  4. 04

    Departments with separate directories

    Shared IT services don't mean shared identity. Agencies often still run several directories and identity providers, and each one handles joiners, department transfers and leavers its own way.

  5. 05

    Fixed budgets and procurement cycles

    Projects are scoped against a fiscal year and a contract vehicle. Designs have to work with the licenses the agency already holds rather than an ideal stack.

how we help
  1. 01

    Authorization readiness for vendors

    We define the system boundary, map the controls and collect evidence for FedRAMP, GovRAMP and TX-RAMP submissions. Most of our effort goes on identity, access and logging, because that's where findings cluster.

  2. 02

    Workforce identity consolidation

    One workforce identity provider across departments, on Entra ID or Okta. HR drives the lifecycle automation, and users who reach CJI get MFA that meets CJIS policy.

  3. 03

    Resident identity

    A single resident sign-in across agency services, on OIDC and passkeys, with accessible recovery. Agencies share the front door. They don't share records.

  4. 04

    Case management and service portals

    Permits, licensing, inspections and constituent service on Salesforce, Dynamics 365 or Power Platform government cloud offerings, with roles mapped to agency staff and partner organizations.

  5. 05

    Governed data sharing between agencies

    We turn each data sharing agreement into access policy on the data platform, and audit logs show which agency queried which records and when.

typical situations

Situations we walk into

We pieced these together from public sector situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

A TX-RAMP Level 2 solicitation and a product with provisional status

composite · not a client story
  1. Beforethe situation

    A case management SaaS vendor sells to Texas agencies and cities. Now a solicitation requires TX-RAMP Level 2. The product only has a provisional status, and nobody has ever mapped its identity and logging controls to NIST SP 800-53.

  2. What we dothe work

    First we draw the system boundary and map identity, access and audit controls to the baseline the solicitation asks for. MFA, admin access and log retention are the gaps we close first. Then we look at whether an existing third-party audit qualifies for the Program Manual 4.0 fast-track review.

  3. Afterwhere you end up

    This time the submission goes in with the boundary drawn and the MFA, admin access and log retention evidence ready, because that's where findings usually land. The vendor also knows whether the fast-track route applies to later bids.

case file 02

Officers reaching the records system from patrol cars with a password

composite · not a client story
  1. Beforethe situation

    A county sheriff's office lets officers into the records management system from patrol car laptops with nothing but a password. The CJIS audit is next year. The county already runs Entra ID for staff, and the RMS vendor supports SAML.

  2. What we dothe work

    We bring officers into the county's Entra ID tenant with MFA methods that work in a patrol car, federate the RMS through SAML and turn on the audit logging the CJIS Systems Agency expects. The design goes to the CSA for review before rollout.

  3. Afterwhere you end up

    Officers sign in to the RMS with MFA from the car, and every record opened is logged to a named officer. The CSA reviewed the design before the auditors arrived, so the audit wasn't the first look.

architecture

How staff, officers and residents reach agency services

Two front doors. Staff and law enforcement use one workforce identity provider with MFA, and residents use a separate resident identity service. Behind them, case, CJI and portal systems produce the control evidence that authorization reviews and CJIS audits ask for.

How staff, officers and residents reach agency services Two front doors. Staff and law enforcement use one workforce identity provider with MFA, and residents use a separate resident identity service. Behind them, case, CJI and portal systems produce the control evidence that authorization reviews and CJIS audits ask for. 01 · PEOPLE 02 · IDENTITY 03 · AGENCY SERVICES 04 · EVIDENCE SSO MFA sign-in OIDC CJIS-compliant MFA OIDC control evidence control evidence access logs Agency staff employees · contractors Law enforcement users officers · dispatch ·courts Residents web · mobile Ex Workforce identity Entra ID · MFA ·Conditional Access Resident identity one sign-in ·passkeys D365 Case management Dynamics 365 · PowerApps CJI systems RMS · CAD · state switch Sf Resident portal SalesforceExperience Cloud Authorization package FedRAMP · GovRAMP ·TX-RAMP CJIS audit evidence MFA · audit logs ·addendum
Read the diagram as text
  1. Agency staff → Workforce identity: SSO
  2. Law enforcement users → Workforce identity: MFA
  3. Residents → Resident identity: sign-in
  4. Workforce identity → Case management: OIDC
  5. Workforce identity → CJI systems: CJIS-compliant MFA
  6. Resident identity → Resident portal: OIDC
  7. Case management → Authorization package: control evidence
  8. Resident portal → Authorization package: control evidence
  9. CJI systems → CJIS audit evidence: access logs
case studies

Work on the platforms public sector runs on

All case studies
migration CRM, ITSM and automation

Siebel or homegrown CRM to Salesforce or Dynamics 365

We replace Siebel or homegrown CRMs with Salesforce or Dynamics 365 and move business logic, data and integrations deliberately.

read the case study
migration Identity and access

On-premises Active Directory to cloud-first Microsoft Entra ID

We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.

read the case study
migration Identity and access

ForgeRock AM/IDM to PingOne Advanced Identity Cloud

Moving self-managed ForgeRock AM and IDM, now called PingAM and PingIDM, to PingOne Advanced Identity Cloud without breaking sign-in or provisioning.

read the case study
consolidation Identity and access

Consolidating Okta and Entra ID after years of running both

Picking one primary identity provider after years of running Okta and Microsoft Entra ID side by side, then moving apps, MFA and provisioning to it.

read the case study
upgrade Identity and access

IdentityIQ 8.x to 9.0 upgrade

Upgrading SailPoint IdentityIQ 8.x to 9.0, with the route through 8.5, the iiq-precheck scan, javax to jakarta fixes and a tested rollback.

read the case study
migration Identity and access

SailPoint IdentityIQ to Identity Security Cloud

Leaving IdentityIQ for SailPoint Identity Security Cloud (formerly IdentityNow) with custom logic, certifications and audit history carried across.

read the case study
talent and delivery · public sector

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
due diligence · public sector

Questions to ask any partner, including us.

Put these to anyone bidding on your public sector work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Which authorization should we pursue first: FedRAMP, GovRAMP or TX-RAMP?

    The order depends on your buyers. Texas accepts FedRAMP or GovRAMP status toward TX-RAMP, and FedRAMP plans to stop accepting new Rev5 certifications on 11 June 2027, so timing matters.

  2. Q2

    Which CJIS Security Policy version will you design to, and who confirms it?

    Version 6.1 came out on 25 June 2026. That doesn't mean your audit will use it. Your CJIS Systems Agency decides, so the design should go in front of them early.

  3. Q3

    What's your process for capturing evidence of our identity and logging controls while the authorization review is under way?

    In FedRAMP, GovRAMP and TX-RAMP reviews, findings tend to land on access, MFA and audit logging. Configs and screenshots captured while the controls go in are cheaper than recreating them for the assessor.

  4. Q4

    Will your design work with the licenses and contract vehicles we already hold?

    Budgets get set one fiscal year at a time. A design that needs a license you never bought sits waiting on procurement, sometimes until next year's budget.

  5. Q5

    How will you handle CMMC if we also hold DoD contracts?

    The 13 July 2026 suspension covered Phase 2 third-party assessments only. Self-assessments, SPRS affirmations and DFARS 252.204-7012 are untouched. If you're a university or public body with DoD work, cover both tracks.

01We sell software to governments. Should we pursue FedRAMP, GovRAMP or TX-RAMP first?

It depends on who your buyers are. Federal agencies need FedRAMP. Many states and localities accept GovRAMP, and Texas accepts FedRAMP or GovRAMP status toward TX-RAMP. If most of your pipeline is state and local, GovRAMP or TX-RAMP is usually the faster first step. We review your target accounts before recommending an order.

02Can we use a commercial cloud identity provider for users who access CJI?

It can, as long as the provider and your configuration meet the CJIS Security Policy, including MFA and audit logging. Vendors that can reach CJI sign the CJIS Security Addendum as well. The CJIS Systems Agency decides in the end, so we bring them in at design time.

03Is CMMC paused?

Partly. On 13 July 2026 the Department of War suspended Phase 2, which would have required third-party Level 2 assessments. Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations still apply. DFARS 252.204-7012 obligations haven't changed. We'd plan as though third-party assessment is coming back.

04Can residents use one login across several agencies?

Yes. A shared resident identity service can issue OIDC tokens to each agency's portal while each agency keeps its own records and consent. The hard parts are agreeing who runs it and how account recovery works for people without a smartphone.

05Do you work for agencies directly, or for the vendors who sell to them?

Both. Agencies bring us in for identity, CRM and data work. Software vendors bring us in to prepare identity and logging controls for FedRAMP, GovRAMP or TX-RAMP reviews.

services

Services for public sector

The services public sector clients ask us for most, alongside the work on this page.

you are herePublic sector
sources 8 sources linked last checked 2026-10-20 content fingerprint 905ed0eb
  1. 01FedRAMP: FedRAMP 20x phases and Rev5 timelinefedramp.gov ↗
  2. 02GovRAMP: StateRAMP announces rebrand to GovRAMP (Feb 2025)govramp.org ↗
  3. 03Texas DIR: TX-RAMP program pagedir.texas.gov ↗
  4. 04Texas DIR: TX-RAMP Program Manual 4.0 (effective 12 Feb 2026)dir.texas.gov ↗
  5. 05FBI: CJIS Security Policy v6.1 (25 Jun 2026)le.fbi.gov ↗
  6. 06eCFR: 32 CFR Part 170, CMMC Programecfr.gov ↗
  7. 07DoD CIO: Memorandum implementing the suspension of CMMC Phase II (Jul 2026)dodcio.defense.gov ↗
  8. 08WilmerHale: Pentagon suspends CMMC Phase 2 requirements (20 Jul 2026, secondary source)wilmerhale.com ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it