Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · oklahoma city

Oklahoma City's biggest employers are the state and an Air Force depot. Their access rules travel downstream.

Walk the Greater Oklahoma City major-employer list and the top two lines are the State of Oklahoma and Tinker Air Force Base. Below them sit hospital systems, the FAA's Aeronautical Center and several energy headquarters. Each hands its contractors rules that mostly come down to who can log in to what.

Talk to an engineer
work in oklahoma city7 services
4 local rules covered below
in short·20-second read

For Oklahoma City organizations we design identity governance, privileged access and data pipelines.

State agencies and their vendors ask for access reviews and audit evidence. Aerospace suppliers around Tinker need CMMC-ready controls on systems holding controlled unclassified information. Hospital systems want a written security program that holds up under the state's hospital safe-harbor law. We work from our Frisco, Texas office and travel to Oklahoma City for workshops and launches.

There's no Cohash office in Oklahoma City. Our team works from Frisco, Texas, roughly 200 miles to the south, handles build work remotely and drives up for discovery sessions, design workshops and go-live support.

Ask an engineer facts checked 2026-10-21 · 11 sources
rules
Oklahoma Security Breach Notification Act, 24 O.S. §§161–166Oklahoma Consumer Data Privacy ActOklahoma Hospital Cybersecurity Protection Act of 2023CMMC Program, 32 CFR Part 170
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
oklahoma city by the numbers

What's specific about Oklahoma City

Each figure comes from a public source, linked on the card.

01 32,500

The Greater Oklahoma City Economic Development major-employers list (viewed October 2026) puts the State of Oklahoma first at 32,500 employees and Tinker Air Force Base second at 26,000. INTEGRIS Health follows at 11,000.

source ↗ 02 1,100

The FAA's Mike Monroney Aeronautical Center covers about 1,100 acres and 133 buildings in Oklahoma City, and the agency says it is home to over 6,300 federal employees, contractors and students.

source ↗ 03 129,700

Government accounts for 129,700 of the Oklahoma City metro's 713,900 nonfarm jobs in September 2026 (preliminary), per the BLS, slightly ahead of education and health services at 129,300.

source ↗ 04

The Information Technology Consolidation and Coordination Act of 2011 charged the Office of Management and Enterprise Services, based in Oklahoma City, with unifying state agency IT, building on the 2009 law that created the state CIO post.

source ↗ 05

The Oklahoma Health Care Authority moved more than half of SoonerCare members into SoonerSelect managed care plans on 1 April 2024, run by Aetna Better Health of Oklahoma, Humana Healthy Horizons in Oklahoma and Oklahoma Complete Health.

source ↗
who and what

Who we work with in Oklahoma City, and the rules they work under

industries

  1. State agencies and their vendors

    With IT consolidated under OMES, many agencies share directories and infrastructure, yet each one owns its program data and its contractors. The access problem we see is caseworker and vendor accounts that outlive the contract. We set up identity governance with agency-level owners, quarterly certifications and a clean audit trail that a legislative or federal auditor can follow.

  2. Aerospace sustainment and defense suppliers

    Depot work at Tinker pulls in engineering firms, parts suppliers and software contractors who handle technical data marked as controlled unclassified information. CMMC Level 2 turns on MFA, least privilege and session logging for every account that touches that enclave. We scope the enclave, put privileged access in front of it and produce the evidence an assessor will ask for.

  3. Hospital systems and Medicaid plans

    INTEGRIS, OU Health, Mercy and SSM all run large clinical workforces, and since 2024 they also trade member data with the SoonerSelect plans. We tie clinical access to credentialing and role, cut shared logins on nursing units, and build the governed data feeds that plans and providers trade.

  4. Energy headquarters

    Devon, Expand Energy and OGE Energy keep corporate offices in the metro, with field operations spread across the state. The gap is usually between corporate IAM and the service accounts that move production, metering and land data into analytics platforms. We inventory those machine identities and put rotation and ownership on each.

regulations

  1. Oklahoma Security Breach Notification Act, 24 O.S. §§161–166 ↗

    As amended by SB 626 from 1 January 2026, biometric data and government-issued ID numbers now count as personal information. Breaches touching 500 or more Oklahomans also go to the Attorney General within 60 days of notifying residents. Documented reasonable safeguards shield an entity from civil penalties.

  2. Oklahoma Consumer Data Privacy Act (SB 546) ↗

    Signed in March 2026 and effective 1 January 2027. It reaches controllers handling data on 100,000 or more Oklahoma consumers, or 25,000 with over half of revenue from data sales. Nonprofits and colleges are exempt. The Attorney General enforces it after a 30-day cure notice, with penalties up to $7,500 per violation.

  3. Oklahoma Hospital Cybersecurity Protection Act of 2023 (HB 2790) ↗

    Voluntary, but valuable. A hospital that keeps and documents a written cybersecurity program conforming to a recognized framework such as the HIPAA Security Rule, reviewed at least yearly, gains an affirmative defense to tort claims after a data breach.

  4. CMMC Program, 32 CFR Part 170 ↗

    Applies to defense contractors and subcontractors handling federal contract information or CUI. Phase 1 started 10 November 2025 with the DFARS clause and remains in place. Phase 2, which would have added third-party Level 2 certification to many contracts from 10 November 2026, was suspended on 13 July 2026 pending a review.

services

Most requested in Oklahoma City

The services clients in Oklahoma City ask us for most.

you are hereOklahoma City
01We supply parts and engineering to Tinker. How do we get ready for a CMMC Level 2 assessment?

Start by drawing the boundary. Find every system, laptop and cloud tenant that stores or sends CUI, then shrink that set as far as you can. We handle the identity and access controls inside it, which is a large share of the NIST SP 800-171 requirements. The assessment itself has to come from an authorized C3PAO, and we are not one.

02What changed in Oklahoma's breach law this year?

SB 626 took effect on 1 January 2026. The definition of personal information is broader, a breach affecting 500 or more residents must also be reported to the Attorney General, and an entity with documented reasonable safeguards avoids civil penalties if it notified properly. Confirm your obligations with counsel.

03Our hospital already follows HIPAA. Does the 2023 hospital act ask for anything more?

It asks you to write the program down, tie it to a recognized framework, review it every year and keep proof that you did. Many hospitals have the controls but not the documentation. We help with the access-control parts and the evidence trail behind them.

04Can you work alongside OMES on a state agency project?

Yes, as a vendor through whatever contract vehicle the agency uses. Agency identity work often touches shared infrastructure that OMES runs, so we plan the design with their team from the first workshop.

05When does the Oklahoma privacy act start, and are we covered?

It takes effect 1 January 2027. Count the Oklahoma consumers whose data you process in a year. Below 100,000, you're likely outside it unless data sales are most of your revenue. Nonprofits, higher education and HIPAA-regulated data are exempt.

oklahoma

More cities in Oklahoma

All 82 cities
TulsaMidstream energy & aircraft MRO
sources 11 sources linked last checked 2026-10-21 content fingerprint d0639ad3
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02Greater Oklahoma City Economic Development, major employersgreateroklahomacity.com ↗
  3. 03FAA, Aeronautical Center Storyfaa.gov ↗
  4. 04BLS, Oklahoma City economy at a glancebls.gov ↗
  5. 05OMES, History of IT unificationoklahoma.gov ↗
  6. 06OHCA, SoonerSelect health plans launch April 1 (March 2024)oklahoma.gov ↗
  7. 07Oklahoma SB 626, enrolled textoklegislature.gov ↗
  8. 08Oklahoma SB 546, enrolled textoklegislature.gov ↗
  9. 09Hunton, Oklahoma enacts comprehensive consumer privacy lawhunton.com ↗
  10. 10Oklahoma HB 2790 (2023), enrolled textoklegislature.gov ↗
  11. 11eCFR, 32 CFR Part 170 (CMMC Program)ecfr.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it