Orlando signs in tens of millions of park guests a year, plus the engineers who build military simulators.
Orlando security teams talk about two very different crowds. One is the guest buying tickets, booking a room and tapping a wristband at a ride. The other is the simulation engineer near UCF writing training software for the armed services. Both need accounts that open fast and close on time.
- Customer Identity (CIAM)Cybersecurity
- Identity & Access ManagementCybersecurity
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Governance, Risk & ComplianceCybersecurity
- HCM & Payroll PlatformsEnterprise Platforms
- Mobile DevelopmentApplication Services
Cohash works with Orlando hospitality companies, simulation and training contractors and health systems on identity, access and data.
Resorts and attractions need guest sign-in that resists fraud and PCI-ready controls for staff who touch payments. Simulation firms need CMMC-aligned access control around controlled defense data. We're headquartered in Frisco, Texas, run Orlando work remotely and travel in for workshops and launches.
Cohash has no Orlando office. We run projects from Frisco, Texas, work with Central Florida teams remotely and travel in for discovery, design workshops and opening-day cutovers.
- rules
- Florida breach notification, Fla. Stat. §501.171Florida Digital Bill of RightsPCI DSS v4.0.1, requirement 8.4.2CMMC Program, 32 CFR Part 170
What's specific about Orlando
Each figure comes from a public source, linked on the card.
Orlando welcomed 76,663,200 visitors in 2025, Visit Orlando reports, made up of 70,325,600 domestic and 6,337,600 international travelers.
source ↗ 02 1,507Leisure and hospitality account for 297.2 thousand of the Orlando-Kissimmee-Sanford metro's 1,507.7 thousand nonfarm jobs, BLS estimates for September 2026 (preliminary).
source ↗ 03 $5 billionTeam Orlando calls itself the world's biggest cluster of modeling, simulation and training organizations. Its military commands sit in the Central Florida Research Park by UCF, and it cites more than $5 billion in annual obligation authority across the services.
source ↗ 04 57.7 millionOrlando International handled 57.7 million passengers in 2025, seventh among US airports, according to the Miami-Dade Aviation Department's ranking of ACI data.
source ↗Who we work with in Orlando, and the rules they work under
-
Resorts, attractions and hotels
Parks and resorts hire thousands of seasonal workers ahead of summer and the holidays, and many of them use shared tills and handhelds. We drive provisioning from the HR system so a seasonal hire gets the right badge, app roles and payment access on day one, and loses all of it on their last shift.
-
Guest accounts and ticketing apps
One guest profile often links tickets, hotel stays, dining reservations and stored cards. That makes it a target for credential stuffing and resale fraud. We add passkeys, bot screening and step-up checks on high-value changes such as a new payment method or a ticket transfer, while keeping checkout quick.
-
Simulation and training contractors
Firms building training systems for the services often handle controlled unclassified information next to commercial game-engine work. We draw the CUI boundary, give engineers separate identities inside it, and put administrators and build servers behind privileged access with logged sessions.
-
Health systems
Central Florida hospital networks keep adding clinics and staff, and clinicians move between campuses. We connect EHR and departmental apps to one identity source, tighten role changes when someone transfers, and give compliance teams access reports they can actually read.
-
Florida breach notification, Fla. Stat. §501.171 ↗
Late notice is costly. A covered entity that misses the 30-day deadline faces $1,000 a day for the first 30 days, then $50,000 for each further 30-day period, up to $500,000 per breach. The Department of Legal Affairs enforces it as an unfair trade practice.
-
Florida Digital Bill of Rights ↗
The part took effect 1 July 2024. Its consumer-rights duties fall on controllers with more than $1 billion in revenue meeting one extra test, so most hotels and attractions are outside them. They should still check the sensitive-data sale rule in section 501.715.
-
PCI DSS v4.0.1, requirement 8.4.2 ↗
Since 31 March 2025, multi-factor authentication is required for all non-console access into the cardholder data environment, which goes well past the old remote and admin rule. That reaches resort front desks, retail and food systems wherever they sit in scope.
-
CMMC Program, 32 CFR Part 170 ↗
Orlando simulation contractors on DoD work face CMMC self-assessment requirements in solicitations from 10 November 2025. Third-party Level 2 certification was due to follow in November 2026, but the Department of War suspended it on 13 July 2026 pending a review.
Most requested in Orlando
The services clients in Orlando ask us for most.
01We hire thousands of seasonal workers each spring. How do we keep their access from lingering after the season?
Make the HR record the only way access starts and ends. When the end date is in the HR system, every connected app closes the account on that date, and a nightly report catches the ones that couldn't be automated, such as legacy point-of-sale terminals.
02Does PCI DSS 4.0 really require MFA for front-desk staff?
Requirement 8.4.2 covers all non-console access into the cardholder data environment, which includes logging into a web or network application from a workstation. If your property management or point-of-sale system is in scope, staff logging into it need MFA or the system needs to come out of scope. Tap-to-badge with a PIN usually keeps the line moving. Your QSA makes the final call on scope.
03Our simulation work mixes commercial and DoD projects. Do we need CMMC everywhere?
Only where federal contract information or CUI lives. Many contractors build a separate enclave for DoD work with its own identity controls, which keeps the assessment smaller. We help design that boundary and the access rules at its edge.
04Can we add passkeys to our guest app without breaking existing logins?
Yes. Passkeys go in as an option alongside the current password, offered after a successful sign-in. Guests who switch stop being exposed to stuffing attacks, and the rest keep working as before while you track adoption.
More cities in Florida
771d3d94 - 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
- 02Visit Orlando, data and trendsvisitorlando.org ↗
- 03BLS, Orlando-Kissimmee-Sanford economy at a glancebls.gov ↗
- 04Team Orlando, aboutteamorlando.org ↗
- 05Miami-Dade Aviation Department, 2025 US airport rankingsmiami-airport.com ↗
- 06Fla. Stat. §501.171flsenate.gov ↗
- 07Florida Digital Bill of Rights, Fla. Stat. ch. 501 part Vflsenate.gov ↗
- 08PCI Security Standards Council document librarypcisecuritystandards.org ↗
- 09Federal Register, CMMC program rulefederalregister.gov ↗
- 10Federal Register, DFARS CMMC acquisition rulefederalregister.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it