State departments report incidents to CDT immediately. Can yours say which accounts were involved?
About a quarter of the jobs in the Sacramento metro are in government. Departments run benefits, licensing and tax systems built over decades, and they follow the Office of Information Security's SAM and SIMM rules. Contractors who build or run those systems inherit the same rules.
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Mainframe ModernizationApplication Services
- Customer Identity (CIAM)Cybersecurity
- Identity Threat Detection & ResponseCybersecurity
- Data Governance & AccessData & Analytics
In Sacramento we work with state departments, public pension and health programs, and the system integrators that serve them.
The work covers identity governance across legacy and cloud systems, privileged access for administrators and vendors, and data pipelines that respect California's Information Practices Act. We help departments produce the access records incident reports and audits ask for. Cohash is based in Frisco, Texas, serves Sacramento remotely and travels in for workshops and launches.
We have no Sacramento office. Cohash is headquartered in Frisco, Texas, works with Sacramento departments and vendors remotely, and travels to the capital for discovery workshops, design reviews and go-live.
- rules
- Information Practices Act breach rule, Civil Code §1798.29State Administrative Manual 5300 and SIMM 5340California Consumer Privacy Act
What's specific about Sacramento
Each figure comes from a public source, linked on the card.
Government accounts for about 266.0 thousand of the 1,106.0 thousand nonfarm jobs in the Sacramento metro, BLS data for September 2026 (preliminary) show, ahead of education and health services at 222.6 thousand.
source ↗ 02 $637.1 billionCalPERS, which issues its releases from Sacramento, reported $637.1 billion in its Public Employees' Retirement Fund as of June 30, 2026, and says it serves 2.4 million members.
source ↗ 03The California Privacy Protection Agency, which now goes by CalPrivacy, lists its office at 400 R Street, Suite 350, in Sacramento.
source ↗ 04The California Department of Technology describes Cal-Secure 2.0 as the state's multi-year roadmap for information security maturity across the Executive Branch, replacing the 2021 compliance checklist.
source ↗Who we work with in Sacramento, and the rules they work under
-
State departments and agencies
Benefits, licensing and tax systems mix mainframe RACF or ACF2 accounts, Active Directory and newer cloud apps, each with its own access request form. We bring them into identity governance with role models per program and set up access certifications that Office of Information Security auditors can test.
-
Public pensions and benefit administrators
Member portals hold Social Security numbers, bank details and beneficiary records, so account takeover is the main threat. We add phishing-resistant MFA for staff, risk checks on member logins and on direct deposit changes, and separate admin accounts with recorded sessions.
-
Health programs and regional hospital systems
Medi-Cal administration and large hospital systems in the region share eligibility and claims data across programs and counties. We build the pipelines and role-based access so analysts get de-identified sets by default and named access only with approval.
-
System integrators and state vendors
Firms that build or operate systems for a department must follow its security requirements. We set up vendor accounts that expire with the contract, keep privileged vendor sessions recorded and give the department read access to those logs.
-
Information Practices Act breach rule, Civil Code §1798.29 ↗
Applies to state agencies. A department must notify California residents whose unencrypted personal information was acquired by an unauthorized person, and send a sample notice to the Attorney General when more than 500 residents are notified from one breach.
-
State Administrative Manual 5300 and SIMM 5340 ↗
State entities report incidents through Cal-CSIRS to the Office of Information Security and the CHP immediately on discovery, file a written incident report within ten business days, and send breach notices to OIS for review before they go to affected people.
-
California Consumer Privacy Act ↗
Covers businesses, not state agencies, so it reaches the integrators, health systems and private employers around Sacramento. CalPrivacy, which enforces it with the Attorney General, sits in Sacramento, and its 2026 regulations add risk assessments and cybersecurity audits.
Most requested in Sacramento
The services clients in Sacramento ask us for most.
01How does SIMM 5340 change our incident response playbook?
It front-loads reporting. The first Cal-CSIRS entry goes in immediately with whatever you know, so your playbook needs a quick way to pull which accounts touched the affected system. We set up identity logs and queries that answer that in minutes, which also feeds the written report due within ten business days.
02Can identity governance reach our mainframe accounts?
Yes. Most governance platforms connect to RACF, ACF2 or Top Secret through a connector or a scheduled file feed. We map mainframe groups to business roles so certifiers see plain descriptions instead of cryptic group names.
03Does the CCPA apply to our department?
No. State agencies fall under the Information Practices Act, not the CCPA. Your contractors and vendors may still be CCPA businesses for their own data, which matters when you review their security commitments.
04Can you work under a prime integrator on a state contract?
We often work as a specialist alongside a prime. Whether that's possible on a given contract depends on its terms and the department's approval, so we confirm with the prime and the contract manager before scoping.
1f4eb582 - 01BLS, Sacramento-Roseville-Folsom economy at a glancebls.gov ↗
- 02CalPERS, preliminary return for fiscal year 2025-26 (13 July 2026)calpers.ca.gov ↗
- 03California Privacy Protection Agency, contactcppa.ca.gov ↗
- 04California Department of Technology, Cal-Securecdt.ca.gov ↗
- 05California Department of Technology, security policycdt.ca.gov ↗
- 06California Civil Code §1798.29leginfo.legislature.ca.gov ↗
- 07California Attorney General, data breach reportingoag.ca.gov ↗
- 08California Privacy Protection Agency, regulationscppa.ca.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it