Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · los angeles

Unreleased footage and container moves both pass through contractor logins nobody switched off.

A Los Angeles production can bring freelancers, post houses and VFX vendors into one asset library for a few months. Down at San Pedro Bay, terminal operators, truckers and customs brokers share another set of systems. In both places access tends to outlive the job, and that is usually where our work begins.

Talk to an engineer
work in los angeles6 services
4 local rules covered below
in short·20-second read

In Los Angeles we take on identity and data work for studios and post-production houses, port and logistics operators, and health plans and providers.

Typical jobs are vendor and freelancer access with end dates, MFA and least privilege on terminal systems ahead of the Coast Guard's cyber rule, and governed pipelines for medical data covered by California law. Cohash runs these projects remotely from Frisco, Texas, and our consultants fly in for workshops and launches.

Cohash has no Los Angeles office. Our only US office is in Frisco, Texas, so we run Los Angeles engagements remotely and fly in for discovery workshops, vendor onboarding sessions and go-live.

Ask an engineer facts checked 2026-10-21 · 9 sources
rules
California breach notification, Civil Code §1798.82California Consumer Privacy Act, as amended by the CPRAConfidentiality of Medical Information Act, Civil Code §56 and followingCoast Guard cybersecurity rule, 33 CFR part 101 subpart F
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
los angeles by the numbers

What's specific about Los Angeles

Each figure comes from a public source, linked on the card.

01 4,171

Greater Los Angeles logged 4,171 on-location shoot days from July through September 2026, down 4.8% from 4,380 a year earlier, FilmLA reports. Projects backed by the state film tax credit made up 40.3% of scripted on-location filming that quarter.

source ↗ 02 10.2 million

The Port of Los Angeles handled about 10.2 million TEUs and $301 billion in cargo in calendar 2025. It says it has been the top container port in the Western Hemisphere every year from 2000 through 2025 and supports 126,000 jobs in the city, about 1 in 16.

source ↗ 03 1,043

Education and health services account for about 1,043.9 thousand of the 4,593.8 thousand nonfarm jobs in the Los Angeles-Long Beach-Glendale division, and the information sector, home to film and TV production, for 165.8 thousand, in BLS data for September 2026 (preliminary).

source ↗
who and what

Who we work with in Los Angeles, and the rules they work under

industries

  1. Film, TV and post-production

    A show's crew list changes weekly, and its vendors hold credentials to dailies, cuts and VFX plates. We tie access to the production calendar so it ends when a vendor's work wraps, replace shared editing-bay logins with named accounts, and alert on bulk downloads from asset managers in the weeks before a release.

  2. Port terminals, drayage and customs brokers

    Terminal operating systems, gate appointment apps and broker portals each keep their own accounts, and plenty are shared by shift. The Coast Guard rule now spells out lockouts, MFA on remotely reachable OT and revoking credentials when people leave. We inventory those accounts, move vendor remote sessions behind a PAM gateway and write up the account security section of the Cybersecurity Plan.

  3. Medi-Cal plans and provider groups

    Managed care plans, delegated medical groups and county programs pass claims and clinical records back and forth all day. California's medical privacy statute limits who may see them, so we build role-based access in the warehouse, mask member fields for analysts and log every extract that leaves the platform.

regulations

  1. California breach notification, Civil Code §1798.82 ↗

    Since 1 January 2026, after SB 446, businesses must notify affected California residents within 30 calendar days of discovering a breach, with delays allowed for law enforcement or to scope the incident. When more than 500 residents are notified, a sample notice goes to the Attorney General within 15 days of the consumer notice.

  2. California Consumer Privacy Act, as amended by the CPRA ↗

    Enforced by the California Privacy Protection Agency (CalPrivacy) and the Attorney General. Regulations effective 1 January 2026 start risk assessment duties that day, apply automated decisionmaking rules from 1 January 2027, and phase in cybersecurity audit certifications from 1 April 2028 by company revenue.

  3. Confidentiality of Medical Information Act, Civil Code §56 and following ↗

    California's medical privacy law covers providers, health plans and their contractors and restricts disclosing medical information without the patient's authorization. In places it goes further than HIPAA, so access designs for clinical and claims data get checked against both.

  4. Coast Guard cybersecurity rule, 33 CFR part 101 subpart F ↗

    Effective 16 July 2025 for MTSA-regulated facilities and US-flagged vessels. Owners report cyber incidents to the National Response Center without delay, require MFA on password-protected IT and remotely accessible OT, and must finish a cyber assessment and submit a Cybersecurity Plan within 24 months of the effective date.

services

Most requested in Los Angeles

The services clients in Los Angeles ask us for most.

you are hereLos Angeles
01Can you cut off a VFX vendor's access the day their work wraps?

Yes, as long as access carries an end date when it is granted. We set up time-bound access packages in your identity governance tool keyed to the production schedule, and owners get a reminder before expiry so any extension is a decision someone made. Shared logins are the harder part, so we replace those with named accounts first.

02Does the Coast Guard cyber rule apply to our terminal or warehouse?

It covers facilities regulated under the Maritime Transportation Security Act, plus US-flagged vessels and Outer Continental Shelf facilities. A warehouse inland with no MTSA facility security plan is usually outside it. Your Facility Security Officer or counsel confirms scope, and we take the account security and access sections once that is settled.

03How fast do we have to notify Californians after a breach now?

Within 30 calendar days of discovery since SB 446 took effect in January 2026, unless law enforcement asks for a delay or you need time to determine scope. If more than 500 residents get a notice, the Attorney General gets a sample within 15 days. Counsel owns the notice; we help produce the account and access timeline it depends on.

04Can our analysts query Medi-Cal claims without seeing member identities?

For most work, yes. We put column masking and row filters in the warehouse so analysis runs on tokenized member IDs, and keep re-identification in a separate role that needs approval. Some care management and quality work does need identities, and that access is logged and reviewed monthly.

california

More cities in California

All 82 cities
Irvine, Orange CountyMedical devices & health care SacramentoState government & public pensions San DiegoNavy, defense tech & genomics San FranciscoAI labs, fintech & banking San JoseChips, hardware & enterprise IT
sources 9 sources linked last checked 2026-10-21 content fingerprint acb814ea
  1. 01FilmLA, Q3 2026 production report (21 October 2026)filmla.com ↗
  2. 02Port of Los Angeles, facts and figuresportoflosangeles.org ↗
  3. 03BLS, Los Angeles-Long Beach-Glendale economy at a glancebls.gov ↗
  4. 04California Civil Code §1798.82leginfo.legislature.ca.gov ↗
  5. 05Pillsbury, California SB 446 breach notification changespillsburylaw.com ↗
  6. 06California Privacy Protection Agency, regulationscppa.ca.gov ↗
  7. 07Hunton, staggered compliance dates for the 2026 CCPA regulationshunton.com ↗
  8. 08California Civil Code §56.10 (CMIA)leginfo.legislature.ca.gov ↗
  9. 09Federal Register, Cybersecurity in the Marine Transportation System (govinfo)govinfo.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it