Hotels and hospital wards run around the clock. So do the accounts that reach guest and patient data.
O‘ahu welcomed about 5.67 million visitors by air in 2025, and every stay leaves passport, card and loyalty details across hotel, airline and tour systems. The island's hospitals, health plan and military installations hold their own sensitive records, and much of the staff works shifts on shared terminals.
- Identity & Access ManagementCybersecurity
- Customer Identity (CIAM)Cybersecurity
- Identity Governance & AdministrationCybersecurity
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- Governance, Risk & ComplianceCybersecurity
- Data Governance & AccessData & Analytics
In Honolulu we work with hotel and resort operators, health systems and health plans, and defense contractors.
Typical projects are passwordless sign-in for shift staff on shared devices, guest data governance across property and loyalty systems, clinical access governance, and CMMC-aligned controls for contractors. Cohash serves Honolulu remotely from Frisco, Texas, and we fly in for workshops and launches, scheduled around the time difference.
Cohash has no Hawaii office. We work from Frisco, Texas, run Honolulu projects remotely with meeting times set for Hawaii hours, and fly to O‘ahu for discovery workshops, property rollouts and go-live.
- rules
- Hawaii breach notification, HRS §487N-2CMMC program and DFARS clause
What's specific about Honolulu
Each figure comes from a public source, linked on the card.
O‘ahu drew about 5.67 million visitors arriving by air in 2025, who spent about $9.35 billion, according to the state's 2025 annual visitor research tables.
source ↗ 02Government accounts for about 93.4 thousand of the 458.7 thousand nonfarm jobs in Urban Honolulu, and leisure and hospitality for 74.0 thousand, per BLS for September 2026 (preliminary).
source ↗ 03 9,400The Queen's Health Systems, at 1301 Punchbowl Street in Honolulu, describes itself as the state's biggest private employer, with over 9,400 employees.
source ↗ 04HMSA, an independent licensee of the Blue Cross and Blue Shield Association, says it covers more than half of Hawaii's population.
source ↗Who we work with in Honolulu, and the rules they work under
-
Hotels, resorts and travel
Front desk, housekeeping and spa staff share terminals while property management, loyalty and payment systems each keep guest records. We give shift workers badge or PIN sign-in with device trust, merge guest identities across systems and limit who can export guest lists or arrival manifests.
-
Health systems and health plans
With one plan covering more than half the state, claims and clinical data flow among a few large organizations and neighbor-island clinics. We build role-based access for clinicians who work on several islands and governed pipelines for plan analytics and quality reporting.
-
Defense contractors
Firms supporting the bases on O‘ahu handle CUI and often run commercial and government cloud tenants side by side. We scope the enclave, set up MFA and privileged access, and document the controls for a CMMC assessment.
-
Hawaii breach notification, HRS §487N-2 ↗
Businesses and government agencies notify affected people without unreasonable delay. A business notifying more than 1,000 people at one time must also tell the State Office of Consumer Protection and the nationwide consumer reporting agencies about the timing, distribution and content of the notice.
-
CMMC program and DFARS clause ↗
The program rule has applied since 16 December 2024 and the contract clause since 10 November 2025, phased in over three years. Contractors on O‘ahu whose systems process FCI or CUI should expect the clause in new awards and plan their assessment ahead of bids.
Most requested in Honolulu
The services clients in Honolulu ask us for most.
01Can housekeeping and front desk staff use passwordless sign-in on shared terminals?
Usually. Badge tap with a short PIN works well on shared front desk and back-office terminals, and it logs each person separately. The choice depends on what your property management and point-of-sale systems support, which we check first.
02Does Hawaii have a consumer privacy law like California's?
Hawaii's main statute here is the breach notification law in chapter 487N, and we are not aware of a comprehensive consumer privacy act in force as of October 2026. Confirm with counsel, since bills are introduced most sessions and guests from other states bring their own laws with them.
03How do you handle the time difference?
We schedule working sessions in Hawaii business hours and plan cutovers for your low-occupancy windows. Most build and testing work happens remotely, and on-island visits cover workshops and launch.
04Do you work with PCI DSS requirements for hotel payments?
On the identity side, yes. Unique IDs, MFA into the cardholder data environment and access reviews map to PCI DSS requirements 7 and 8. We are not a QSA and don't assess compliance.
f859dc33 - 01Hawaii DBEDT, 2025 annual visitor research tablesfiles.hawaii.gov ↗
- 02Hawaii DBEDT, annual visitor research reportsdbedt.hawaii.gov ↗
- 03BLS, Urban Honolulu economy at a glancebls.gov ↗
- 04The Queen's Health Systems, about usqueens.org ↗
- 05HMSA, abouthmsa.com ↗
- 06HRS §487N-2 (Hawaii Legislature)capitol.hawaii.gov ↗
- 07HRS §487N-2 text (FindLaw)codes.findlaw.com ↗
- 08Federal Register, CMMC program rule (govinfo)govinfo.gov ↗
- 09PCI Security Standards Council document librarypcisecuritystandards.org ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it