Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · madison

Madison's big employers are state government, a research university and a health records vendor.

Dane County's employers include a state government, a university with about 28,000 faculty and staff, and an electronic health record vendor in Verona. Each holds sensitive data for people who will never visit Madison. The identity questions differ but rhyme. Access piles up faster than anyone takes it away.

Talk to an engineer
work in madison7 services
3 local rules covered below
in short·15-second read

Around Madison we work with health software companies, Wisconsin state agencies, university research groups and insurers.

The work covers workforce and privileged access tied to NIST 800-53 based state standards, research data governance, AI governance for clinical and claims models, and identity controls behind Wisconsin's insurer cybersecurity law. Cohash is headquartered in Frisco, Texas, serves Madison remotely and travels in for workshops and launches.

Cohash does not have a Madison office. We're based in Frisco, Texas, deliver Wisconsin work remotely and travel to Madison for discovery workshops, control assessments with agency staff and go-live support.

Ask an engineer facts checked 2026-10-21 · 9 sources
rules
Wisconsin breach notice law, Wis. Stat. §134.98Wisconsin DET IT security policies and standardsWisconsin insurer cybersecurity events, Wis. Stat. §601.954
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
madison by the numbers

What's specific about Madison

Each figure comes from a public source, linked on the card.

01 97,100

Government accounts for about 97,100 of the Madison metro's 433,500 nonfarm jobs in BLS figures for September 2026 (preliminary). Information, the sector that includes software publishers, employs about 21,200.

source ↗ 02 325 million

Epic, the health record software company based in Verona, says more than 325 million patients have a current electronic record in Epic. It was founded in 1979 with three half-time employees.

source ↗ 03 51,822

UW–Madison reports 51,822 students and 28,017 faculty and staff for fall 2025, and ranks itself 5th nationally for research expenditure in 2024.

source ↗ 04

American Family Insurance lists its headquarters at 6000 American Parkway in Madison and says the company turns 100 in 2027.

source ↗ 05

Wisconsin's Division of Enterprise Technology says its executive branch IT security policies and standards are derived from NIST SP 800-53 Revision 5.

source ↗ 06

Wisconsin's consumer data protection bill, 2025 Assembly Bill 172, won a 10 to 0 recommendation from the Assembly State Affairs committee on 30 January 2026, then failed to pass on 23 March 2026.

source ↗
who and what

Who we work with in Madison, and the rules they work under

industries

  1. Health software and EHR vendors

    A health software company's support, implementation and hosting staff can often reach customer environments full of patient records. We design just-in-time privileged access to hosted customer systems, tie each session to a ticket and a customer, and keep keys and service accounts for integrations under rotation.

  2. State agencies

    Agencies in Madison follow DET policies built on NIST 800-53, so account management, MFA and audit logging controls come with assessments attached. We map identity platforms to those controls, clean up dormant and shared accounts, and give security staff privileged access logs they can search during an incident.

  3. University research and life sciences

    Research groups get data access through grants, IRB approvals and data use agreements, and that access rarely ends on schedule. We connect research identity to the approval records so access expires with the protocol, and we scope research data platforms per project.

  4. Insurance and financial services

    Insurers around Madison now train models on claims and member data. We set up AI governance for those models, covering approved data sources, access to training sets and review records, alongside the access controls Wisconsin's insurance data security law expects.

regulations

  1. Wisconsin breach notice law, Wis. Stat. §134.98 ↗

    Covers businesses and also state agencies, cities, villages, towns and counties. Notice must come within a reasonable time and no later than 45 days after the entity learns of the acquisition. HIPAA-compliant health care entities and GLBA-compliant financial institutions with a breach policy are exempt.

  2. Wisconsin DET IT security policies and standards ↗

    Sets a baseline of security policies and controls for executive branch agencies, derived from NIST SP 800-53 Revision 5, including the IT Security Policy Handbook and IT Security Standards Handbook.

  3. Wisconsin insurer cybersecurity events, Wis. Stat. §601.954 ↗

    Insurance licensees give the commissioner electronic notice no later than 3 business days after determining a cybersecurity event occurred. The section comes from 2021 Wisconsin Act 73, which also requires a written information security program.

services

Most requested in Madison

The services clients in Madison ask us for most.

you are hereMadison
01Our support engineers can reach customer EHR environments. How do we cut that down?

Remove standing access first. Engineers request a session for a specific customer and ticket, a broker grants it for a set time, and the session is recorded. Customers can see who touched their environment, and you can answer their security questionnaires with logs.

02Does Wisconsin's breach law apply to state agencies?

Yes. Section 134.98 includes the state and its political subdivisions in the definition of entity, so agencies follow the same 45-day outer limit as private companies. Agencies also report incidents through DET's channels, so we plan the identity evidence to serve both.

03Can you map our identity controls to the DET security standards?

Yes. Because DET's standards derive from NIST 800-53 Rev 5, we map account management, identification and authentication, and audit controls to your platforms, then list the gaps with owners and dates.

04Is there a Wisconsin privacy law we should plan for?

Wisconsin has no comprehensive consumer privacy law today. AB 172 failed to pass in March 2026. A future session could revive it, so we build consent and data inventory work in a way that would carry over.

05Will someone from Cohash come to Madison?

For workshops, assessment interviews and launches, yes. Day-to-day work runs remotely from Frisco.

wisconsin

More cities in Wisconsin

All 82 cities
MilwaukeeAutomation, payments & insurance
sources 9 sources linked last checked 2026-10-21 content fingerprint ff47f294
  1. 01BLS, Madison economy at a glancebls.gov ↗
  2. 02Epic, aboutepic.com ↗
  3. 03Epic, contact (Verona, Wisconsin)epic.com ↗
  4. 04UW–Madison factswisc.edu ↗
  5. 05American Family Insurance, aboutamfam.com ↗
  6. 06Wisconsin DET, IT policies and standardsdet.wi.gov ↗
  7. 07Wisconsin Legislature, 2025 Assembly Bill 172docs.legis.wisconsin.gov ↗
  8. 08Wis. Stat. §134.98docs.legis.wisconsin.gov ↗
  9. 09Wis. Stat. §601.954docs.legis.wisconsin.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it