Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · tucson

Tucson suppliers guard defense CUI while its labs share data with the world. Both need sharper access rules.

About one Tucson job in five is a government job, a count that takes in a public research university and an Air Force base. Around them work defense manufacturers, machine shops and optics makers holding controlled technical data. A research team wants data to travel. A missile subcontractor wants it to stay put.

Talk to an engineer
work in tucson6 services
4 local rules covered below
in short·20-second read

Our Tucson work is for defense contractors and their suppliers, optics and instrument makers, and organizations that run research alongside the University of Arizona.

We set up access control and identity evidence for CMMC Level 2, keep CUI and export-controlled files inside enclaves, and build governance for research datasets shared between institutions. Cohash delivers from Frisco, Texas, with no Tucson office, and we travel in for workshops and launches.

We don't have a Tucson office. Cohash works with Southern Arizona organizations remotely from Frisco, Texas, and our consultants fly in for scoping workshops, assessment readiness reviews and launch weeks.

Ask an engineer facts checked 2026-10-21 · 9 sources
rules
Arizona breach notification, A.R.S. §18-552CMMC program, 32 CFR Part 170DFARS CMMC clause ruleITAR, 22 CFR Parts 120 to 130
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
tucson by the numbers

What's specific about Tucson

Each figure comes from a public source, linked on the card.

01 $1,012,404,000

The University of Arizona reported $1,012,404,000 in research expenditures for fiscal year 2024. In the NSF HERD survey that ranked it No. 19 among US public research institutions and 35 among all US institutions, the university said in January 2026.

source ↗ 02

The University of Arizona's Richard F. Caris Mirror Lab spin casts large honeycomb telescope mirrors from Ohara E-6 low-expansion glass in a rotating oven, and lists the Giant Magellan Telescope among its mirror castings.

source ↗ 03 79,900

Government accounts for about 79,900 of the Tucson metro's roughly 406,300 nonfarm jobs and manufacturing for about 28,400, going by BLS data for September 2026 (preliminary).

source ↗ 04 2 million

The UA Tech Park, run by the University of Arizona, advertises 2 million square feet of customizable space for tenants drawn from more than 10 industries.

source ↗
who and what

Who we work with in Tucson, and the rules they work under

industries

  1. Defense manufacturing and its supply chain

    Primes in Tucson push CUI down to machine shops, cable makers and electronics assemblers, many with a single IT person. CMMC Level 2 expects the NIST SP 800-171 controls on every system that touches that data. For a small supplier the affordable route is often a tight CUI enclave with phishing-resistant MFA, role-based access and logs an assessor can read.

  2. Optics, photonics and instruments

    Optics and instrument firms sell into astronomy, defense and medical markets, sometimes from the same engineering team. A lens design can be open science on Monday and ITAR technical data on Tuesday. We organize engineering files and PLM access by project and export status, so a drawing's classification decides who can open it.

  3. University research partnerships

    Joint grants put company staff, faculty and students from several institutions on the same datasets. Access tends to outlive the grant by years. We tie each dataset grant to its data use agreement and end date, accept federated sign-in where partners support it, and remove access when a project or appointment closes.

regulations

  1. Arizona breach notification, A.R.S. §18-552 ↗

    Sets a 45-day limit for telling affected people, counted from the determination that a breach occurred. Once more than 1,000 people need notice, it also goes to the Attorney General, the Arizona Department of Homeland Security director and the three nationwide credit bureaus.

  2. CMMC program, 32 CFR Part 170 ↗

    In effect since 16 December 2024. Contractors that process CUI generally need Level 2, built on the 110 requirements in NIST SP 800-171 Revision 2, and third-party assessments were due in many contracts from November 2026 until that Phase 2 step was suspended on 13 July 2026 pending a review.

  3. DFARS CMMC clause rule (DFARS Case 2019-D041) ↗

    Effective 10 November 2025, it lets contracting officers make a current CMMC status a condition of award and requires flow-down to subcontractors handling FCI or CUI. Phase 1 self-assessments apply now, and Phase 2 was suspended on 13 July 2026 pending a review.

  4. ITAR, 22 CFR Parts 120 to 130 ↗

    Technical data for defense articles on the US Munitions List can't be released to foreign persons without State Department authorization. That makes nationality and authorization status an access attribute for engineering systems, which matters in a city where defense and university work sit close together.

services

Most requested in Tucson

The services clients in Tucson ask us for most.

you are hereTucson
01We're a small machine shop with CUI. Do we have to rebuild our whole network for CMMC?

Often not. If CUI reaches only a handful of people and machines, an enclave such as a separate cloud tenant or a segmented set of workstations can shrink what the assessor examines. The cost is friction for staff who move between the enclave and everyday work, so we map who actually touches CUI before recommending a design.

02How do we keep export-controlled files away from foreign national staff without blocking open research?

Put export authorization on the identity as an attribute, sourced from your export control office's decisions, and grant controlled projects only where it matches. Everyone keeps access to open work. We build the mechanism. Classification of the data and licensing decisions stay with your export compliance lead.

03When does CMMC Phase 2 start, and what changes?

Phase 2 was scheduled for 10 November 2026 and would have brought required third-party Level 2 certification into applicable contracts. On 13 July 2026 the Department of War suspended it pending a review by a CMMC Reform Task Force, and as of October 2026 no new date has been announced. Phase 1 self-assessments still apply, so read each solicitation.

04Can our engineers use their company accounts on university research systems?

Frequently. Many universities accept federated sign-in through SAML research federations. Where a partner does, we connect your identity provider so your staff sign in with company credentials and you can end their access the day they leave.

arizona

More cities in Arizona

All 82 cities
PhoenixChips, power & health care
sources 9 sources linked last checked 2026-10-21 content fingerprint 06efb0de
  1. 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
  2. 02University of Arizona News, research expenditures exceed $1B (January 2026)news.arizona.edu ↗
  3. 03Richard F. Caris Mirror Lab, University of Arizonamirrorlab.arizona.edu ↗
  4. 04BLS, Tucson economy at a glancebls.gov ↗
  5. 05UA Tech Parktechparks.arizona.edu ↗
  6. 06A.R.S. §18-552 (Arizona Legislature)azleg.gov ↗
  7. 07eCFR, 32 CFR Part 170 (CMMC Program)ecfr.gov ↗
  8. 08Federal Register, DFARS CMMC rule (10 September 2025)federalregister.gov ↗
  9. 09eCFR, ITAR (22 CFR Subchapter M)ecfr.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it