Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · fort worth

Fighter jets, freight trains and an airline operations center all run on accounts that someone has to govern.

Fort Worth builds military aircraft and helicopters, is home to BNSF's headquarters and American Airlines' campus. Suppliers to the plants face CMMC deadlines, and the railroad answers to TSA cyber directives. All of them run large shift-based workforces.

Talk to an engineer
work in fort worth7 services
4 local rules covered below
in short·15-second read

In Fort Worth, Cohash works with aerospace and defense suppliers, railroads and logistics operators, airlines and financial services firms.

For defense suppliers that means CUI enclaves, MFA and access evidence for CMMC. Rail and cargo operators get privileged access for operational systems and identity for frontline crews. We're based in Frisco, Texas, serve Fort Worth remotely and drive over for workshops, cutovers and launches.

Cohash's US office is in Frisco, about an hour from downtown Fort Worth, and we have none in Fort Worth itself. Build work is remote, and we come to your plant, yard or campus for discovery, workshops and go-live.

Ask an engineer facts checked 2026-10-21 · 10 sources
rules
Tex. Bus. & Com. Code §521.053, breach noticeTexas Data Privacy and Security Act, Bus. & Com. Code ch. 541CMMCTSA rail cybersecurity directives
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
fort worth by the numbers

What's specific about Fort Worth

Each figure comes from a public source, linked on the card.

01 5.4%

Aerospace, defense and security accounts for 5.4 percent of Fort Worth area employment and grew 27 percent from 2016 through 2023, the Dallas Fed reports. It names Lockheed Martin and Bell Textron as the cluster's anchors.

source ↗ 02 37,000

BNSF Railway is headquartered in Fort Worth and had approximately 37,000 employees across the country in 2023, according to the Dallas Fed's Fort Worth profile.

source ↗ 03

Perot Field Fort Worth Alliance Airport, opened in 1989, is a hub for Amazon's air cargo operations and one of the busiest US cargo airports by the Dallas Fed's count, which places it in the national top 25.

source ↗ 04

The oneworld alliance moved its global headquarters from New York to Fort Worth effective December 2022, onto American Airlines' 300-acre Robert L. Crandall Campus next to DFW Airport, American announced.

source ↗ 05 109,500

Manufacturing held about 109,500 of the Fort Worth-Arlington-Grapevine division's 1,217,700 nonfarm jobs in September 2026 (preliminary), with trade, transportation and utilities at 291,800, per BLS.

source ↗ 06 3.5%

Financial services made up 3.5 percent of area employment and grew 21 percent from 2016 to 2023, the Dallas Fed says. Charles Schwab relocated its headquarters from San Francisco to Westlake in 2021.

source ↗
who and what

Who we work with in Fort Worth, and the rules they work under

industries

  1. Aerospace and defense suppliers

    Machine shops, avionics firms and engineering subcontractors in the prime contractors' supply chains hold drawings and specifications marked as CUI, sometimes export-controlled too. Engineers share CAD workstations and vendor portals. We separate those workloads into an enclave with its own identities, require phishing-resistant MFA, and record who opened what, so CMMC evidence comes from logs.

  2. Freight rail and intermodal

    A railroad's dispatch, signaling and yard systems sit behind service accounts and vendor connections that predate the TSA directives. Train crews, mechanics and contractors also need mobile access in the field. We put operational access behind a PAM gateway, rotate the machine credentials, and give field staff sign-in that works on rugged devices and spotty coverage.

  3. Airlines and air cargo

    Airline headquarters and cargo hubs combine crew scheduling, maintenance records and partner booking systems, with alliance partners and ground handlers needing narrow slices of each. We design partner federation and API authorization so a handler sees its own flights and nothing more, and clean up the shared kiosk and tablet logins in hangars and on ramps.

  4. Brokerage and financial operations

    Brokerage and asset-management campuses in Westlake and north Fort Worth run large client-service floors. The work there is customer identity for investors, entitlement reviews for advisors and operations staff, and data pipelines that keep client records consistent between the CRM and the books of record.

regulations

  1. Tex. Bus. & Com. Code §521.053, breach notice ↗

    Notice to each affected individual is due no later than the 60th day after you determine a breach. Breaches touching 250 or more Texas residents also require an electronic report to the Attorney General within 30 days, including the number of Texans affected and whether police are investigating.

  2. Texas Data Privacy and Security Act, Bus. & Com. Code ch. 541 ↗

    In force since 1 July 2024. Consumers can name an agent to opt out on their behalf through a browser setting or a global device setting, so your consent stack has to honor those signals. The Attorney General alone enforces the law.

  3. CMMC (32 CFR 170 and the DFARS clause) ↗

    Phase 1 began with the DFARS rule on 10 November 2025, requiring self-assessed Level 1 or Level 2 status where a solicitation calls for it. Phase 2, which would have added third-party Level 2 certification from 10 November 2026, was suspended on 13 July 2026 pending a review. An award can be blocked if your SPRS status falls short.

  4. TSA rail cybersecurity directives (SD 1580 series) ↗

    TSA reissued SD 1580-21-01, Enhancing Rail Cybersecurity, as version E on 15 January 2026, and SD 1580/82-2022-01, Rail Cybersecurity Mitigation Actions and Testing, as version E on 1 May 2026. Designated railroads should read the current versions for access control and testing duties.

services

Most requested in Fort Worth

The services clients in Fort Worth ask us for most.

you are hereFort Worth
01We're a tier-two supplier to a prime. Will our CMMC level come from the prime or from DoD?

The level is set in the solicitation and flows down through the prime's subcontract, based on whether you'll handle FCI only or CUI. Ask your prime which level your work package carries. If it's Level 2, note that the C3PAO certification step planned for November 2026 is suspended pending a review, so for now the requirement is a self-assessment.

02Can offshore engineers work on our defense program?

That's a question for your export compliance officer and your contract terms before it's one for us. Cohash has offices outside the US, so we agree in the statement of work which tasks and data stay with US-based staff, and set up access so the enclave enforces that split.

03Our yard and shop staff share tablets. Is individual sign-in realistic?

Yes, if it takes seconds. Badge tap, a FIDO2 key on a lanyard or a short PIN with device trust usually works. We test with actual crews at shift change before rollout, because that's when shared logins come back.

04Do the TSA rail directives cover every railroad?

No. They apply to the freight and passenger railroads TSA designates, and the directive text sets the scope. Short lines and contractors outside that list may still see the requirements through their contracts with a designated railroad.

05Does the Texas privacy act require us to honor browser opt-out signals?

Chapter 541 lets consumers opt out through an authorized agent using a browser setting, extension or global device setting, and it can't be a default. Your consent platform needs to read those signals on sites and apps aimed at Texans. Confirm details with counsel.

texas

More cities in Texas

All 82 cities
AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) El PasoDefense, border trade & health HoustonEnergy & pipelines San AntonioMilitary, cyber & member banking
sources 10 sources linked last checked 2026-10-21 content fingerprint 8334b134
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02Dallas Fed, At the Heart of Texas, Fort Worthdallasfed.org ↗
  3. 03American Airlines newsroom, oneworld headquarters to relocate to Fort Worth (2022)news.aa.com ↗
  4. 04BLS, Fort Worth-Arlington-Grapevine economy at a glancebls.gov ↗
  5. 05Texas Business & Commerce Code chapter 521statutes.capitol.texas.gov ↗
  6. 06Tex. Bus. & Com. Code §521.053 (public.law reading copy)texas.public.law ↗
  7. 07Texas Business & Commerce Code chapter 541statutes.capitol.texas.gov ↗
  8. 08Tex. Bus. & Com. Code §541.055 (public.law reading copy)texas.public.law ↗
  9. 09Mayer Brown, DoD final rule implementing CMMC (September 2025)mayerbrown.com ↗
  10. 10TSA security directives and emergency amendmentstsa.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it