Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · huntsville

Huntsville contractors handle CUI every day. CMMC now asks them to prove who touched it.

Huntsville jobs lean hard on federal programs at Redstone Arsenal and the firms around Cummings Research Park, and many of those firms hold controlled unclassified information. DoD planned to require C3PAO Level 2 status from 10 November 2026 but suspended that step in July 2026.

Talk to an engineer
work in huntsville6 services
4 local rules covered below
in short·20-second read

In Huntsville we help defense contractors, engineering services firms and space suppliers meet the identity and access parts of NIST SP 800-171 and CMMC.

That covers MFA, least privilege, privileged sessions, audit logging and the account lifecycle inside a CUI enclave, plus the evidence an assessor will ask for. We are not a C3PAO. Cohash serves Huntsville remotely from Frisco, Texas and travels in for workshops and go-live.

Our only US office is in Frisco, Texas. Huntsville contractors work with us remotely, and we travel in for scoping workshops, enclave cutovers and assessment-prep sessions.

Ask an engineer facts checked 2026-10-21 · 11 sources
rules
CMMC Program, 32 CFR part 170DFARS CMMC acquisition ruleAlabama data breach law, Ala. Code §8-38-5 and §8-38-8Alabama Personal Data Protection Act
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
huntsville by the numbers

What's specific about Huntsville

Each figure comes from a public source, linked on the card.

01 45,500

Redstone Arsenal had a workforce of about 45,500 people, the City of Huntsville wrote in December 2024, and officials expected it to keep climbing toward 50,000.

source ↗ 02 1,400

President Trump announced in September 2025 that U.S. Space Command's permanent headquarters would move to Redstone Arsenal from Peterson Space Force Base. Mayor Tommy Battle put the direct jobs at roughly 1,400 over five years.

source ↗ 03

Cummings Research Park ranks itself second among US research parks by size and fourth in the world, and says about 300 companies and organizations work there.

source ↗ 04 6,000

NASA's Marshall Space Flight Center in Huntsville lists a workforce of more than 6,000 people on its center page.

source ↗ 05 71,900

Professional and business services account for 71,900 of the Huntsville metro's 298,700 nonfarm jobs in September 2026 (preliminary), per BLS. Government adds another 60,800.

source ↗
who and what

Who we work with in Huntsville, and the rules they work under

industries

  1. Missile defense and Army aviation contractors

    Program offices on the Arsenal hand engineering data to primes and to dozens of small subcontractors. Each firm needs a defined CUI boundary, accounts that disappear the day someone leaves a program, and MFA on every path in. We build the enclave identity design, connect it to HR and program rosters, and write the evidence your System Security Plan cites.

  2. Space launch and propulsion suppliers

    Suppliers to NASA and to commercial launch programs mix export-controlled drawings with ordinary business files on the same network. We separate those with group-based access tied to citizenship and program checks, and log every download from engineering repositories.

  3. Engineering services and IT contractors

    Firms that place engineers on government sites have staff who sign into the customer's systems and their own employer's systems the same day. Shared admin accounts on test labs are common. We vault those accounts, record privileged sessions and give each engineer a named identity that an auditor can trace.

  4. Federal and DoD data programs

    Analytics teams supporting Army and Space Command work need data pipelines that keep classification markings and CUI labels attached as records move. We design lineage and tagging into the pipeline so access rules follow the data into the warehouse.

regulations

  1. CMMC Program, 32 CFR part 170 ↗

    Phase 1 began when the DFARS acquisition rule took effect on 10 November 2025, with Level 1 and Level 2 self-assessments in solicitations. On 13 July 2026 the Department of War suspended Phase 2, which would have required Level 2 status from a C3PAO, pending a review. Phase 1 stays in place.

  2. DFARS CMMC acquisition rule (DFARS Case 2019-D041) ↗

    The final rule published 10 September 2025 and effective 10 November 2025 puts CMMC level requirements into DoD contract clauses, so a contracting officer can make a current CMMC status a condition of award.

  3. Alabama data breach law, Ala. Code §8-38-5 and §8-38-8 ↗

    Residents hear about a qualifying breach within 45 days. A third-party agent, such as a managed service provider, has no more than 10 days to tell the covered entity after it determines a breach happened, which matters for contractors that outsource IT.

  4. Alabama Personal Data Protection Act (HB 351) ↗

    Takes effect 1 May 2027 for businesses with data on more than 25,000 Alabama consumers or more than 25% of revenue from selling personal data. Employee and job applicant data is excluded, so for a defense contractor it mostly reaches any consumer-facing products.

services

Most requested in Huntsville

The services clients in Huntsville ask us for most.

you are hereHuntsville
01Are you a C3PAO, and can you certify us?

No. A CMMC Third-Party Assessment Organization runs the Level 2 certification assessment. We work on the identity and access controls before that, and we can sit with your team during readiness reviews to explain how the controls are built.

02We use GCC High. What is left to do on identity?

The tenant gives you the platform, and the controls still need configuring. Conditional access, privileged role activation, guest account rules, device compliance and log retention all have to match what your System Security Plan says. Gaps between the plan and the tenant settings are what assessors find.

03Which CMMC phase applies to our next proposal?

Phase 1, which began 10 November 2025. The Department of War suspended Phase 2, due 10 November 2026, on 13 July 2026 pending a review, and as of October 2026 no new date has been announced. The solicitation states the required level and assessment type, so read that first. If a bid you care about lists Level 2, the identity work usually needs months, so start early.

04Can you work on site at Redstone Arsenal?

Access to the Arsenal depends on your sponsorship and the installation's rules, and we do not assume it. Most of our work happens in your own environment, remotely or at your Huntsville office during workshop visits.

alabama

More cities in Alabama

All 82 cities
BirminghamBanking & academic medicine
sources 11 sources linked last checked 2026-10-21 content fingerprint a54eaafa
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02City of Huntsville blog, Redstone Arsenal economic impact (December 2024)cityblog.huntsvilleal.gov ↗
  3. 03Army.mil, Redstone Arsenal lands Space Command (September 2025)army.mil ↗
  4. 04Cummings Research Parkcummingsresearchpark.com ↗
  5. 05NASA Marshall Space Flight Centernasa.gov ↗
  6. 06BLS, Huntsville economy at a glancebls.gov ↗
  7. 07Federal Register, CMMC Program final rule (32 CFR 170)federalregister.gov ↗
  8. 08Federal Register, DFARS CMMC acquisition rulefederalregister.gov ↗
  9. 09Ala. Code §8-38-5 (Justia)law.justia.com ↗
  10. 10Alabama Data Breach Notification Act text (ACUA copy)acua.alabama.gov ↗
  11. 11Mayer Brown, Alabama enacts comprehensive consumer data privacy law (April 2026)mayerbrown.com ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it