Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · buffalo

Buffalo's biggest employers are hospitals and a bank. Both now answer to state cyber rules with deadlines.

Health care employs more people in Western New York than any other sector, and New York's hospital cybersecurity rule took full effect in October 2025. Banks and insurers licensed by DFS have Part 500 on top of that. So a Buffalo engagement usually opens with MFA on remote access and a list of who holds admin rights.

Talk to an engineer
work in buffalo6 services
4 local rules covered below
in short·20-second read

In Buffalo we work with hospital systems, cancer research centers, banks, insurers, aerospace and industrial manufacturers, and power producers.

The work is MFA and privileged access for clinical and financial systems, identity governance for researchers and contractors, and access control for plant and generation networks. We map it to 10 NYCRR 405.46 and DFS Part 500. Cohash serves Buffalo remotely from Frisco, Texas and travels in for workshops and launches.

Cohash has no Buffalo office. We work from our Frisco, Texas headquarters with Western New York organizations and fly in for discovery workshops, hospital go-lives and control-room cutovers.

Ask an engineer facts checked 2026-10-21 · 8 sources
rules
NY hospital cybersecurity requirements, 10 NYCRR 405.46NYDFS cybersecurity regulation, 23 NYCRR Part 500New York breach notice, GBL §899-aaSHIELD Act safeguards, GBL §899-bb
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
buffalo by the numbers

What's specific about Buffalo

Each figure comes from a public source, linked on the card.

01 9,553

Kaleida Health tops Invest Buffalo Niagara's 2026 major employers list with 9,553 employees, followed by Catholic Health and M&T Bank at 7,938 each, using 2026 Business First Book of Lists figures. The same page puts health care first among the region's employment sectors.

source ↗ 02

Education and health services accounted for 108.5 thousand of the Buffalo-Cheektowaga metro's 560.1 thousand nonfarm jobs in September 2026, with manufacturing at 50.9 thousand, per preliminary BLS data.

source ↗ 03 53,000

Roswell Park, founded in 1898 on what is now the Buffalo Niagara Medical Campus, is New York's only NCI-designated comprehensive cancer center outside New York City. It reports caring for more than 53,000 patients in the past year.

source ↗ 04 2.6 million

The New York Power Authority's Niagara Power Project in Lewiston can generate up to 2.6 million kilowatts and is the state's biggest electricity producer, NYPA says. It first produced power in 1961.

source ↗
who and what

Who we work with in Buffalo, and the rules they work under

industries

  1. Hospital systems

    Multi-hospital systems carry thousands of clinicians, traveling nurses, students and affiliated physicians, and many reach the EHR from home or another facility. Section 405.46 wants MFA on that external access unless the CISO signs off on compensating controls. We find every remote path, put MFA in front of it and document the exceptions the CISO approves.

  2. Cancer research and academic medicine

    Researchers keep access to study data long after a grant closes, and clinical and research identities for one person often live in separate directories. We link those identities, expire research access when the protocol ends and route the access reviews to the principal investigator who actually knows the team.

  3. Banking and insurance operations

    Large bank and insurer back offices run claims, servicing and call-center platforms with high staff turnover. DFS expects MFA for every user and limited privileged access. We automate joiner, mover and leaver steps from HR so a call-center agent who changes teams loses yesterday's entitlements the same day.

  4. Aerospace, manufacturing and power generation

    Plants making flight controls or running turbines reach engineering and control networks through vendor laptops and shared jump boxes. Defense work brings NIST SP 800-171 obligations as well. We put those paths behind vaulted, recorded sessions and give each vendor its own named account.

regulations

  1. NY hospital cybersecurity requirements, 10 NYCRR 405.46 ↗

    Applies to Article 28 general hospitals. Adopted 2 October 2024 with one year to comply. Hospitals name a CISO, run an annual risk assessment, use MFA for external network access and report cyber incidents to the Department of Health within 72 hours. Audit trail records are kept six years.

  2. NYDFS cybersecurity regulation, 23 NYCRR Part 500 ↗

    Reaches banks, insurers and other financial firms licensed by DFS, so check each legal entity's license. Covered entities must apply MFA broadly, keep an asset inventory, restrict privileged accounts and file an annual compliance statement by 15 April.

  3. New York breach notice, GBL §899-aa ↗

    Businesses notify affected New Yorkers within 30 days of discovering a breach, and also tell the Attorney General, the Department of State and the State Police. A hospital may also owe the 72-hour Department of Health report under 405.46.

  4. SHIELD Act safeguards, GBL §899-bb ↗

    Requires reasonable administrative, technical and physical safeguards for New Yorkers' private information. Organizations that comply with HIPAA, GLBA or Part 500 are treated as compliant.

services

Most requested in Buffalo

The services clients in Buffalo ask us for most.

you are hereBuffalo
01Our hospital missed parts of 405.46. Where should we focus first?

Start with MFA on external access and the 72-hour incident reporting path, since those are the parts an incident will test right away. Then confirm your CISO designation, the annual risk assessment and six-year audit log retention. We handle the identity and logging pieces. Your counsel and compliance office own the filings.

02Do hospitals also need to follow DFS Part 500?

Usually no. Part 500 covers DFS-licensed financial firms. A health system that owns an insurance company or HMO licensed by DFS may have that affiliate in scope, so check your licenses. The breach law and SHIELD Act apply to both kinds of organization.

03How do you handle traveling nurses and agency staff?

We create them from the staffing agency feed with an end date already set, give them only the units they are assigned to and require MFA from day one. When the contract ends their access closes automatically, without waiting for a manager to file a ticket.

04Can you work on our plant or generation control network?

We work on the access layer, which means jump hosts, PAM, vendor accounts and session recording. Control system engineering and safety changes stay with your OT engineers and their vendors. We coordinate cutovers with them and plan around outage windows.

new york

More cities in New York

All 82 cities
AlbanyState government & chip research New YorkNYDFS-regulated finance
sources 8 sources linked last checked 2026-10-21 content fingerprint c7cd07d2
  1. 01Invest Buffalo Niagara, 2026 major employersbuffaloniagara.org ↗
  2. 02BLS, Buffalo-Cheektowaga economy at a glancebls.gov ↗
  3. 03Roswell Park, about usroswellpark.org ↗
  4. 04NYPA, Niagara Power Projectnypa.gov ↗
  5. 0510 NYCRR 405.46 (Cornell LII)law.cornell.edu ↗
  6. 06NYDFS Cybersecurity Resource Centerdfs.ny.gov ↗
  7. 07NY General Business Law §899-aanysenate.gov ↗
  8. 08NY General Business Law §899-bbnysenate.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it