Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · charleston

In Charleston the capitol, the power company and the hospital each answer to a different auditor.

As the state capital, Charleston does much of its technology work inside agencies that face an annual cyber review. The same few square miles hold an electric utility's headquarters, subject to NERC CIP, and a regional hospital system with thousands of clinical accounts. Each one wants proof of who can log in.

Talk to an engineer
work in charleston, west virginia6 services
3 local rules covered below
in short·20-second read

In Charleston we work with state agencies and their contractors, electric and gas utilities, and hospital systems.

For agencies, that means identity governance and access evidence for the state Cybersecurity Office's annual review. For utilities, it means vendor remote access and multifactor authentication that hold up to NERC CIP-005. For hospitals, it means clinical role design and access reviews. We serve Charleston remotely from Frisco, Texas, and travel in for workshops and launches.

There is no Cohash office in West Virginia. We work from Frisco, Texas, support Charleston organizations remotely and come in person for discovery, design workshops and launch weeks.

Ask an engineer facts checked 2026-10-21 · 8 sources
rules
West Virginia breach notification, W. Va. Code 46A-2A-102West Virginia Cybersecurity Program, W. Va. Code 5A-6B-4NERC CIP-005-7, Electronic Security Perimeters
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
charleston, west virginia by the numbers

What's specific about Charleston, West Virginia

Each figure comes from a public source, linked on the card.

01 22,900

Government accounts for 22,900 and education and health services for 24,900 of the Charleston, WV metro's 104,600 nonfarm jobs in September 2026 (preliminary), per BLS. Together that is nearly half of local employment.

source ↗ 02 1,138

Charleston Area Medical Center describes itself as a nonprofit, 1,138-bed regional referral center across seven hospitals, with nearly 8,000 employees. It is part of Vandalia Health, which also includes Mon Health System.

source ↗ 03 1.1 million

Appalachian Power, an American Electric Power operating company, is headquartered in Charleston. It serves about 1.1 million customers in 57 counties across Tennessee, Virginia and West Virginia, with 2,880 employees and 8,750 MW of generating capacity.

source ↗ 04

The West Virginia Office of Technology provides IT services to state agencies, runs a Cyber Security function with audit and risk assessment programs, and takes security incident reports through an online form.

source ↗ 05

State law places the West Virginia Cybersecurity Office inside the Office of Technology, led by the Chief Information Security Officer. Higher education institutions, the State Police, constitutional officers, the Legislature and the Judiciary are outside its scope.

source ↗
who and what

Who we work with in Charleston, West Virginia, and the rules they work under

industries

  1. State agencies and their contractors

    Agencies running on centrally supported infrastructure follow enterprise cybersecurity standards and sit through a yearly program review. The questions in those reviews tend to land on identity. Who has admin rights, which accounts belong to people who left, which vendors still have access? We automate joiner, mover and leaver flows and produce access-review evidence that survives the review.

  2. Electric and gas utilities

    Control centers and substations rely on equipment vendors who support systems remotely. NERC CIP-005 wants that interactive remote access to pass through an intermediate system with multifactor authentication, and wants a way to see and cut active vendor sessions. We design and run that path, and keep the records for audit.

  3. Hospital systems

    A multi-hospital system with teaching programs has residents and students rotating in and out on top of its permanent staff. Accounts accumulate. We map clinical roles to the EHR and ancillary systems, tie access to credentialing and rotation schedules, and run reviews so departed learners lose access on time.

regulations

  1. West Virginia breach notification, W. Va. Code 46A-2A-102 ↗

    Owners or licensees must notify West Virginia residents without unreasonable delay when a breach causes or is likely to cause identity theft or fraud. Notices to more than 1,000 people also go to the nationwide consumer reporting agencies, except for entities under GLBA Title V.

  2. West Virginia Cybersecurity Program, W. Va. Code 5A-6B-4 ↗

    Information custodians supported by the Office of Technology must undergo cyber risk assessments, follow the Chief Information Security Officer's standards, route policy exceptions to that officer and join an annual program review before 30 November each year.

  3. NERC CIP-005-7, Electronic Security Perimeters ↗

    For high and medium impact BES Cyber Systems, interactive remote access must go through an intermediate system with encryption and multifactor authentication. Entities need ways to detect and disable active vendor remote access, and they keep compliance evidence for three calendar years.

services

Most requested in Charleston, West Virginia

The services clients in Charleston, West Virginia ask us for most.

you are hereCharleston, West Virginia
01Our agency has its annual review with the Office of Technology this fall. Where can you help?

On the identity side. We pull accounts from your directory and key applications, flag orphaned and over-privileged ones, and set up recurring access reviews so you have dated evidence for the 30 November review instead of a spreadsheet built the week before.

02Does West Virginia have a consumer privacy law like Virginia's?

We have not found a comprehensive consumer privacy statute in force in West Virginia as of October 2026. The breach statute, federal sector rules such as HIPAA and GLBA, and your contracts set most obligations. Confirm the current position with counsel.

03Can vendor remote access to our substations meet CIP-005 without slowing outage response?

Yes, if it is designed for emergencies. We set up an intermediate system with MFA, pre-approved vendor accounts that are disabled by default, and a fast enable-and-record step your control room can run in minutes.

04Do you need to be on site to run an access review for a hospital?

Mostly no. Data extraction, role mining and reviewer workflows run remotely. We come to Charleston for the workshops where department leaders agree on clinical roles, since those go faster in a room.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 8 sources linked last checked 2026-10-21 content fingerprint d786b255
  1. 01BLS, Charleston, WV economy at a glancebls.gov ↗
  2. 02Charleston Area Medical Center, about CAMCcamc.org ↗
  3. 03Appalachian Power, about usappalachianpower.com ↗
  4. 04West Virginia Office of Technologytechnology.wv.gov ↗
  5. 05W. Va. Code 5A-6B-1 (West Virginia Legislature)code.wvlegislature.gov ↗
  6. 06W. Va. Code 5A-6B-4 (West Virginia Legislature)code.wvlegislature.gov ↗
  7. 07W. Va. Code 46A-2A-102 (West Virginia Legislature)code.wvlegislature.gov ↗
  8. 08NERC CIP-005-7 standardnerc.com ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it