Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · colorado springs

Space Force units, NORAD and their contractors share a city. Their access records must satisfy DoD assessors.

Work in Colorado Springs follows the bases. Contractors supporting Peterson, Schriever and the Academy handle controlled unclassified information, and the CMMC clauses now appearing in Defense contracts expect proof of who can reach it. Local cyber and software firms selling to those programs inherit it too.

Talk to an engineer
work in colorado springs7 services
4 local rules covered below
in short·15-second read

Our Colorado Springs work centers on defense, space and cybersecurity contractors.

We set up identity and access controls that map to NIST SP 800-171 and CMMC, privileged access for engineering and ground-system environments, and lifecycle governance for staff who move between programs. Cohash works from Frisco, Texas, serves Colorado Springs remotely, and travels in for workshops and launches.

We don't have staff based in Colorado Springs. Cohash works from Frisco, Texas, runs engagements remotely, and sends people up for discovery, design workshops and cutovers.

Ask an engineer facts checked 2026-10-21 · 10 sources
rules
CMMC Program, 32 CFR Part 170DFARS CMMC contract clause ruleColorado breach notification, C.R.S. §6-1-716Colorado Privacy Act
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
colorado springs by the numbers

What's specific about Colorado Springs

Each figure comes from a public source, linked on the card.

01 56,700

Government accounts for about 56,700 of the Colorado Springs metro's roughly 331,600 nonfarm jobs, going by BLS figures for September 2026 (preliminary).

source ↗ 02 $3 billion

A Newmark study cited by the Colorado Springs Chamber & EDC puts the city's aerospace and defense contribution at $3 billion in 2024, with an industry labor pool of more than 18,000 and five military installations.

source ↗ 03

An October 2026 Chamber & EDC release lists Space Force Combat Forces Command, Peterson and Schriever Space Force Bases, NORAD and US Northern Command in Colorado Springs, as US Space Command headquarters prepares to move to Alabama.

source ↗ 04 $5.6 billion

The region's cybersecurity and technology sector generated $5.6 billion in 2024, the Chamber & EDC says, and UCCS opened a 26,000-square-foot cybersecurity education and research center in 2022.

source ↗ 05

The National Cybersecurity Center in Colorado Springs lists the Space ISAC, the information sharing and analysis center for the space sector, among its programs.

source ↗ 06 4,000

More than 4,000 cadets are enrolled at the US Air Force Academy, which commissions officers into both the Air Force and the Space Force.

source ↗
who and what

Who we work with in Colorado Springs, and the rules they work under

industries

  1. Space operations and ground systems

    Satellite command and control, missile warning and mission networks depend on a small group of administrators and a long tail of vendor engineers. Shared admin accounts on ground-system servers are the pattern we see most. We give each person a named identity, route admin work through a PAM gateway with session recording, and expire vendor access when the support ticket closes.

  2. Defense primes and their subcontractors

    Plenty of firms here keep CUI in a separate enclave. The access model is where we put most of the effort. We define who belongs in the enclave, tie access to contract roles and training records, and generate the quarterly account reviews and audit logs an assessor will ask to see.

  3. Cybersecurity and software companies

    Security vendors and software shops selling to the programs around town carry two identity jobs. One is customer login for their own product, often for government tenants. The other is the build pipeline, where tokens and signing keys pile up. We handle both, with phishing-resistant MFA for customers and short-lived credentials in CI.

  4. Cleared and veteran workforce

    People here change programs, contracts and employers often, and each move should change what they can reach. Joiner, mover and leaver rules wired to HR and the security office keep a cleared engineer from carrying old program access into a new role.

regulations

  1. CMMC Program, 32 CFR Part 170 ↗

    Effective 16 December 2024. Sets three CMMC levels for contractors that handle federal contract information or CUI. Level 2 requires the 110 security requirements of NIST SP 800-171 Rev. 2, assessed by the contractor or by a certified third-party assessment organization depending on the contract.

  2. DFARS CMMC contract clause rule (2025) ↗

    Effective 10 November 2025, this rule puts CMMC requirements into Defense solicitations and contracts. For the first three years, program managers and requiring activities decide contract by contract whether to apply them, so requirements arrive unevenly across a supplier's work.

  3. Colorado breach notification, C.R.S. §6-1-716 ↗

    Businesses get 30 days from determining a breach to notify affected Colorado residents. A breach reasonably believed to affect 500 or more residents also goes to the Attorney General within those 30 days. Complying with a federal regulator's breach rules does not remove the Attorney General notice.

  4. Colorado Privacy Act ↗

    The Attorney General has enforced this act since 1 July 2023. It matters for firms here that also handle consumer data, since Colorado residents can ask to access, correct or delete it and can opt out of its sale.

services

Most requested in Colorado Springs

The services clients in Colorado Springs ask us for most.

you are hereColorado Springs
01Can you get us ready for a CMMC Level 2 assessment?

We cover the identity-heavy parts. Access control, identification and authentication, and audit and accountability together hold 42 of the 110 NIST SP 800-171 requirements. We implement those controls and write up the evidence and system security plan sections for them. We are not a C3PAO and we don't certify anyone.

02Space Command headquarters is moving to Huntsville. Does that affect contractors here?

The Chamber & EDC still lists Combat Forces Command, Peterson, Schriever, NORAD and NORTHCOM in Colorado Springs, so much of the program work stays. Firms that support both cities end up with staff and systems in two states. That means one identity platform spanning two sets of facilities, plus Alabama's breach rules alongside Colorado's.

03How should we handle engineers who move between programs?

Treat a program change like a new hire for access purposes. Old program groups come off on the transfer date, new ones are requested and approved by the new program's owner, and the security office sees both changes. That one rule cleans up most of the access creep we find.

04We sell security software to Defense customers. Do you only work on internal IT?

No. We also build customer identity for products, including tenant separation and MFA that government customers will accept, and we clean up secrets and signing keys in build pipelines.

colorado

More cities in Colorado

All 82 cities
DenverLaunch, health & energy
sources 10 sources linked last checked 2026-10-21 content fingerprint 7586472d
  1. 01BLS, Colorado Springs economy at a glancebls.gov ↗
  2. 02Colorado Springs Chamber & EDC, aerospace and defensecoloradospringschamberedc.com ↗
  3. 03Colorado Springs Chamber & EDC, Space Command transition and Golden Dome (October 2026)coloradospringschamberedc.com ↗
  4. 04Colorado Springs Chamber & EDC, cybersecurity and software developmentcoloradospringschamberedc.com ↗
  5. 05National Cybersecurity Centercyber-center.org ↗
  6. 06US Air Force Academy, aboutusafa.edu ↗
  7. 07Federal Register, CMMC Program final rule (32 CFR Part 170)federalregister.gov ↗
  8. 08Federal Register, DFARS CMMC final rulefederalregister.gov ↗
  9. 09Colorado Attorney General, data protection laws and breach reportingcoag.gov ↗
  10. 10Colorado Attorney General, Colorado Privacy Actcoag.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it