Omaha's insurers, railroad and card processors each guard decades of records. Who can open them now?
Omaha is where a life insurer keeps policy files that started on paper, a railroad runs dispatch and crew systems across a continent, and payment processors move card traffic for banks around the country. Each runs on old cores with new APIs on top, and the access question follows the data out.
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Customer Identity (CIAM)Cybersecurity
- Secrets & Certificate LifecycleCybersecurity
- Insurance PlatformsEnterprise Platforms
- Banking & Capital Markets PlatformsEnterprise Platforms
- Data EngineeringData & Analytics
In Omaha we work with insurers, banks and payment processors, rail and logistics companies and contractors supporting the defense mission at Offutt.
The work is identity governance, privileged access, customer identity for policyholder and cardholder portals, and data platforms built on top of older policy and transaction systems. Cohash is based in Frisco, Texas, serves Nebraska clients remotely and flies in for workshops and launches.
Cohash is headquartered in Frisco, Texas, and has no Omaha office. We work with Nebraska organizations remotely and fly up for discovery sessions, design workshops and go-live support.
- rules
- Nebraska breach notification, Neb. Rev. Stat. §87-803Nebraska Data Privacy Act , §§87-1101 to 87-1130CMMC under DFARS 252.204-7021
What's specific about Omaha
Each figure comes from a public source, linked on the card.
Financial activities employ 39,500 of the Omaha-Council Bluffs metro's 526,600 nonfarm workers, according to BLS figures for September 2026 (preliminary).
source ↗ 02The Greater Omaha Chamber lists Berkshire Hathaway, Union Pacific, Peter Kiewit Sons' and Mutual of Omaha among companies headquartered in the region, with Valmont, First National of Nebraska and Werner Enterprises next on its ranking.
source ↗ 03 5,000In the Chamber's employer bands, Offutt Air Force Base, Nebraska Medicine and the University of Nebraska Medical Center each have 5,000 or more workers, and Fiserv, First National Bank of Omaha, Mutual of Omaha and Union Pacific sit in the 2,500 to 4,999 band.
source ↗ 04 $1.3 billionU.S. Strategic Command moved into a $1.3 billion, 916,000-square-foot headquarters at Offutt Air Force Base near Omaha starting in 2019, replacing the LeMay Building from 1957, Military Times reported. More than 3,500 employees were set to relocate.
source ↗ 05The Surface Transportation Board accepted Union Pacific and Norfolk Southern's revised merger application, submitted on 30 April 2026, Supply Chain Dive reported on 28 May 2026. UP said the Board then has 12 months to finish evidentiary proceedings.
source ↗Who we work with in Omaha, and the rules they work under
-
Life, health and supplemental insurance
Policy administration systems here often date back decades, with agents, brokers, call-center staff and third-party administrators all reading the same records. We clean up who holds standing access to policyholder data, move agent and broker logins onto a customer identity platform and build governed data feeds so actuarial and claims teams stop working from copies.
-
Card processing and banking
Payment processors and card issuers in Omaha connect to thousands of banks and merchants, and the service accounts behind those links pile up fast. We inventory machine credentials, tie each to a client contract and an owner, and move operator access to card systems into recorded, time-limited privileged sessions.
-
Railroads and freight
Rail networks run dispatch, crew calling and equipment systems that thousands of field employees and contractors touch from yards and cabs. A merger review means two carriers' identity stacks may eventually have to line up. We document roles and access paths early so a future integration starts from a clean map instead of guesswork.
-
Defense contractors around Offutt
Firms that support the strategic command mission hold controlled unclassified information and need CMMC evidence on top of their own corporate IT. We scope a CUI enclave, enforce MFA and least privilege inside it and produce the access logs and reviews an assessor asks for.
-
Nebraska breach notification, Neb. Rev. Stat. §87-803 ↗
A business must notify affected Nebraska residents as soon as possible and without unreasonable delay once it finds misuse has occurred or is reasonably likely. The Attorney General must be told no later than the residents. A vendor holding data for someone else has to notify and cooperate with the owner.
-
Nebraska Data Privacy Act (LB 1074), §§87-1101 to 87-1130 ↗
In effect since 1 January 2025. It covers businesses operating in Nebraska or serving its residents unless they are small businesses under the federal Small Business Act, though the limit on selling sensitive data applies regardless. The Attorney General enforces it exclusively, with a 30-day cure period and no private right of action.
-
CMMC under DFARS 252.204-7021 ↗
Took effect 10 November 2025 with self-assessment requirements. Third-party Level 2 certification before award was planned from 10 November 2026, but was suspended on 13 July 2026 pending a review, which matters for contractors supporting Offutt and STRATCOM.
Most requested in Omaha
The services clients in Omaha ask us for most.
- CybersecurityIdentity Governance & Administration
- CybersecurityPrivileged Access Management
- CybersecurityCustomer Identity (CIAM)
- CybersecuritySecrets & Certificate Lifecycle
- Enterprise PlatformsInsurance Platforms
- Enterprise PlatformsBanking & Capital Markets Platforms
- Data & AnalyticsData Engineering
01Does the Nebraska Data Privacy Act apply to an insurer or a bank?
Maybe not. Section 87-1103 excludes financial institutions and data subject to Title V of Gramm-Leach-Bliley, and section 87-1104 exempts HIPAA protected health information. Insurers are not named on their own, so ask counsel how GLBA reaches your company and any non-financial affiliates. We build the data inventory and rights-request workflow for whatever stays in scope.
02When do we have to tell the Nebraska Attorney General about a breach?
No later than you tell affected residents. Nebraska ties the two together, so your incident plan should draft both notices at once. The trigger is a finding that misuse of the data has happened or is reasonably likely.
03Our agents and brokers share logins to the policy system. How do we fix that without slowing sales?
Give each agent their own identity on a customer identity platform, linked to the agency they work for, with self-service password reset and MFA. Agency principals approve their own staff. That removes shared logins and puts the joiner and leaver work with the people who know about it.
04We support a defense program at Offutt. Can you help with CMMC?
Yes, on identity and access. We scope where CUI lives, put it behind MFA and role-based access, and keep the audit records an assessor will want to see. A certified third-party assessor runs the assessment itself. We do not.
d8b65f30 - 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
- 02BLS, Omaha-Council Bluffs economy at a glancebls.gov ↗
- 03Greater Omaha Chamber, businesses choose Greater Omahaselectgreateromaha.com ↗
- 04Military Times, STRATCOM headquarters at Offutt (January 2019)militarytimes.com ↗
- 05Supply Chain Dive, UP–NS revised merger application moves ahead (May 2026)supplychaindive.com ↗
- 06Neb. Rev. Stat. §87-803, Nebraska Legislaturenebraskalegislature.gov ↗
- 07Neb. Rev. Stat. §87-1101, Data Privacy Actnebraskalegislature.gov ↗
- 08Hunton, Nebraska enacts comprehensive state privacy lawhunton.com ↗
- 09Squire Patton Boggs, CMMC DFARS final rule (September 2025)squirepattonboggs.com ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it