Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · richmond

Richmond is where Virginia runs its agencies and where card issuers and insurers run their back offices.

Richmond mixes state government with a deep bench of financial employers. Agencies near Capitol Square must report incidents to the Virginia Fusion Intelligence Center within a day. Around the region sit card issuers, insurers and data centers with their own regulators and clocks. Most of them share contractors.

Talk to an engineer
work in richmond7 services
4 local rules covered below
in short·15-second read

For Richmond organizations we build identity governance, privileged access and customer identity that respects Virginia's Consumer Data Protection Act.

Banks and insurers get access models and evidence that satisfy examiners. Agencies and localities get the account logging they need to report incidents within 24 hours. Cohash is headquartered in Frisco, Texas, works with Richmond organizations remotely and travels in for workshops and launches.

Cohash has no Richmond office. We run Virginia work from Frisco, Texas, deliver it remotely and travel to Richmond for discovery, design workshops and go-live.

Ask an engineer facts checked 2026-10-21 · 8 sources
rules
Virginia breach notification, Va. Code §18.2-186.6Virginia Consumer Data Protection Act, Va. Code §59.1-575 et seq.Va. Code §2.2-5514, public body incident reportingBank computer-security incident notification, 12 CFR Part 53
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
richmond by the numbers

What's specific about Richmond

Each figure comes from a public source, linked on the card.

01

The Federal Reserve Bank of Richmond is headquartered in the city, with branches in Baltimore and Charlotte, and its Fifth District covers Virginia, Maryland, the Carolinas, Washington, D.C., and most of West Virginia.

source ↗ 02

Government accounts for 116.1 thousand and financial activities for 59.8 thousand of the Richmond metro's 724.2 thousand nonfarm jobs, BLS estimates for September 2026 (preliminary).

source ↗ 03

VITA, the Commonwealth's IT agency, has its main office on Beaufont Springs Drive in Richmond. It publishes the ITRM policies and standards agencies follow and runs COV Ramp to oversee cloud services.

source ↗ 04

The Greater Richmond Partnership lists finance and insurance, data centers and IT among its target industries, and names Capital One, CarMax, Markel Group and Altria among its investors.

source ↗
who and what

Who we work with in Richmond, and the rules they work under

industries

  1. Card issuers and banks

    Consumer lenders handle millions of customer logins and thousands of employees with access to account data. We tune customer authentication against account takeover, and on the workforce side we build role models and access certifications that hold up when the Fed or OCC samples them.

  2. Insurers and specialty carriers

    Underwriters, claims adjusters and outside agents all need policy data, often through different portals. We consolidate agent and broker identity, give claims staff access tied to their caseload, and log access to sensitive medical and financial claim files.

  3. State agencies and localities

    Virginia public bodies must report qualifying incidents within 24 hours and avoid products banned on federal systems. We focus on MFA for every remote and admin path, privileged account vaulting, and identity logs that show quickly which accounts an attacker touched.

  4. Data centers and cloud operations

    Operators in the region's data center parks manage badge systems, building controls and customer cages alongside IT. We separate facility, operations and customer identities, put remote vendor access behind a broker, and keep machine credentials for monitoring tools under rotation.

regulations

  1. Virginia breach notification, Va. Code §18.2-186.6 ↗

    Owners of computerized personal information notify the Office of the Attorney General and affected residents without unreasonable delay when a breach causes or is believed to cause identity theft or fraud. Over 1,000 notices at once means telling the credit bureaus too.

  2. Virginia Consumer Data Protection Act, Va. Code §59.1-575 et seq. ↗

    In force since 1 January 2023 for businesses that process data on 100,000 or more Virginia consumers a year, or 25,000 if over half their revenue comes from selling data. GLBA financial institutions and HIPAA entities are exempt. The Attorney General enforces it after a 30-day cure notice.

  3. Va. Code §2.2-5514, public body incident reporting ↗

    Every public body, including localities, school boards and public universities, reports qualifying incidents to the Virginia Fusion Intelligence Center within 24 hours of discovery, and may not use hardware, software or services that DHS has prohibited on federal systems.

  4. Bank computer-security incident notification, 12 CFR Part 53 ↗

    A notification incident at a bank goes to its primary federal regulator within 36 hours of the bank determining it occurred. State member banks follow the Federal Reserve's matching rule, and Richmond Fed examiners supervise those in the Fifth District.

services

Most requested in Richmond

The services clients in Richmond ask us for most.

you are hereRichmond
01We're a bank. Does the Virginia Consumer Data Protection Act apply to us?

Financial institutions and data subject to Title V of Gramm-Leach-Bliley are exempt, so the bank itself generally isn't covered. A non-bank affiliate, such as a marketing or rewards company, may be. Ask counsel to map each legal entity.

02Our locality's IT team is small. How do we meet the 24-hour reporting rule?

Prepare before the incident. Collect sign-in and admin logs centrally, know who calls the Fusion Center, and keep a short checklist of which accounts and systems to check first. We help set up those logs and the identity side of the playbook.

03Do Virginia breach rules cover employee tax data?

Yes. Section 18.2-186.6 has a separate clause for employers and payroll providers. If someone gets an employee's taxpayer ID together with withholding information, the Attorney General must be notified, a duty that sits apart from the consumer notice rules.

04Can you consolidate our agent and broker portals onto one identity platform?

Usually. We migrate agents in waves by distribution channel, keep their existing usernames where possible, and map agency hierarchies so a principal can manage their own staff's access instead of calling your help desk.

virginia

More cities in Virginia

All 82 cities
Virginia BeachShipbuilding, Navy & port
sources 8 sources linked last checked 2026-10-21 content fingerprint 955ef34e
  1. 01Federal Reserve Bank of Richmond, about usrichmondfed.org ↗
  2. 02BLS, Richmond economy at a glancebls.gov ↗
  3. 03Virginia Information Technologies Agencyvita.virginia.gov ↗
  4. 04Greater Richmond Partnershipgrpva.com ↗
  5. 05Va. Code §18.2-186.6law.lis.virginia.gov ↗
  6. 06Virginia Consumer Data Protection Act, Va. Code ch. 53 of Title 59.1law.lis.virginia.gov ↗
  7. 07Va. Code §2.2-5514law.lis.virginia.gov ↗
  8. 08eCFR, 12 CFR Part 53ecfr.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it