Lab subcontractors, a chip packaging fab and the academic hospital all draw on one Albuquerque talent pool.
Sandia's headquarters sits in Albuquerque, Intel packages chips next door in Rio Rancho, and UNM runs the state's academic health center. Engineers and clinicians move between employers and contracts, and old accounts tend to outlast the move. So we usually start with controlled data and who can still open it.
- Identity Governance & AdministrationCybersecurity
- Governance, Risk & ComplianceCybersecurity
- Privileged Access ManagementCybersecurity
- OT & ICS SecurityCybersecurity
- Healthcare Provider PlatformsEnterprise Platforms
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- Data Governance & AccessData & Analytics
In Albuquerque we work with research and defense subcontractors, semiconductor suppliers, hospitals and health plans.
The work covers identity governance and access control for controlled unclassified information, privileged access to manufacturing systems, and governed clinical data pipelines. We are headquartered in Frisco, Texas, serve New Mexico organizations remotely and come to Albuquerque for workshops and launches.
Cohash does not have a New Mexico office. We are based in Frisco, Texas, run Albuquerque work remotely, and travel in for discovery, assessment readiness workshops and cutovers.
- rules
- New Mexico Data Breach Notification ActCMMC program, 32 CFR Part 170HIPAA Security Rule, 45 CFR Part 164 Subpart C
What's specific about Albuquerque
Each figure comes from a public source, linked on the card.
Sandia National Laboratories is managed for the NNSA by National Technology and Engineering Solutions of Sandia, a Honeywell subsidiary, and most of its people work at the Albuquerque headquarters or in Livermore, California.
source ↗ 02 $3.5 billionIntel opened Fab 9 in Rio Rancho on 24 January 2024, part of a $3.5 billion investment to equip its New Mexico sites for advanced packaging such as Foveros 3D stacking.
source ↗ 03 1,700UNM Health Sciences reports more than one million patient visits a year and 1,700 clinicians, and estimates it contributes about $1.6 billion a year to the economy.
source ↗ 04Presbyterian Healthcare Services, which began in 1908 as a tuberculosis sanatorium, operates nine hospitals and says it serves one in three New Mexicans with care or coverage.
source ↗ 05Government holds 82.9 thousand of the Albuquerque metro's 418.5 thousand nonfarm jobs, with education and health services at 75.2 thousand, in BLS figures for September 2026 (preliminary).
source ↗Who we work with in Albuquerque, and the rules they work under
-
Research and defense subcontracting
Small and mid-sized firms that support the labs and Air Force research handle controlled unclassified and export-controlled data, often with staff who also hold accounts at a prime contractor. We build an enclave for that data, grant access by contract and citizenship where the contract requires it, and run quarterly attestations so access ends when a task order does.
-
Semiconductor packaging suppliers
Chemical, gas, equipment and maintenance firms around Rio Rancho send technicians into customer sites and connect remotely to tools and monitoring systems. We separate those remote paths from office networks, vault the shared accounts that equipment still depends on and give machine-to-machine connections their own managed credentials.
-
Hospitals and health plans
A system that both delivers care and sells coverage holds patient charts and member claims side by side. We draw the role boundaries between clinical, plan and billing staff, feed provider credentialing into access decisions, and build the pipelines that move clinical and claims data into analytics with consent and minimum-necessary rules applied.
-
New Mexico Data Breach Notification Act (HB 15, 2017) ↗
Affected residents must be told within 45 calendar days of discovery. Notifying more than 1,000 residents also requires notice to the Attorney General and the nationwide consumer reporting agencies. Contracts must bind service providers to reasonable security, and biometric data counts as personal identifying information.
-
CMMC program, 32 CFR Part 170 ↗
The program rule took effect 16 December 2024, and DFARS clause changes that bring CMMC into DoD contracts took effect 10 November 2025. Contractors holding CUI generally need Level 2, built on the NIST SP 800-171 controls for access control and identification and authentication.
-
HIPAA Security Rule, 45 CFR Part 164 Subpart C ↗
New Mexico hospitals and health plans fall under HIPAA, and the state breach act exempts HIPAA-covered entities. The rule expects risk analysis, workforce access management, audit controls and authentication for systems holding electronic health information.
Most requested in Albuquerque
The services clients in Albuquerque ask us for most.
- CybersecurityIdentity Governance & Administration
- CybersecurityGovernance, Risk & Compliance
- CybersecurityPrivileged Access Management
- CybersecurityOT & ICS Security
- Enterprise PlatformsHealthcare Provider Platforms
- Enterprise PlatformsHealthcare Payer Platforms (Facets)
- Data & AnalyticsData Governance & Access
01Does the New Mexico breach law apply to our hospital?
Probably not directly. The act exempts organizations subject to HIPAA or Gramm-Leach-Bliley, so a hospital follows the HIPAA breach rule instead. The state and its political subdivisions are exempt too, which matters for public institutions. Confirm with counsel, since a related business without HIPAA status could still be covered.
02We support a national lab under DOE work and also bid on DoD contracts. Which rules drive our access controls?
CMMC attaches to the DoD contracts, while DOE work carries its own contract security clauses. If you hold both, we build one access control baseline mapped to NIST SP 800-171 so the same evidence answers both sets of reviewers.
03How long do we have to notify New Mexico residents after a breach?
No more than 45 calendar days from discovery, with delays allowed for a law enforcement request or to determine scope and restore the system. Above 1,000 residents you also send the Attorney General the number notified and a copy of the notice.
04Our engineers hold accounts at a prime contractor and at our own firm. How do we keep that straight?
Keep one identity per person in your directory and federate into the prime's systems where they allow it. Each external account gets recorded against the contract that justifies it, with an end date, so a quarterly review can match accounts to active work.
514942d6 - 01Sandia National Laboratories, aboutsandia.gov ↗
- 02Intel newsroom, Fab 9 opening (January 2024)intel.com ↗
- 03UNM Health Sciences, abouthsc.unm.edu ↗
- 04Presbyterian Healthcare Services, aboutphs.org ↗
- 05BLS, Albuquerque economy at a glancebls.gov ↗
- 06New Mexico HB 15 (2017), Data Breach Notification Actnmlegis.gov ↗
- 07eCFR, 32 CFR Part 170ecfr.gov ↗
- 08eCFR, 45 CFR Part 164 Subpart Cecfr.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it