Hampton Roads builds carriers, repairs destroyers and moves containers. Thousands of suppliers need a way in.
From Virginia Beach to Newport News, the economy leans on the Navy, the shipyards and the port. A single ship overhaul can involve hundreds of subcontractors, each needing drawings, work orders or system access for a few months. Keeping that crowd of short-lived accounts in check is the first identity problem here.
- Governance, Risk & ComplianceCybersecurity
- Privileged Access ManagementCybersecurity
- Identity Governance & AdministrationCybersecurity
- OT & ICS SecurityCybersecurity
- Customer Identity (CIAM)Cybersecurity
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- Zero Trust ArchitectureCybersecurity
We help Hampton Roads shipbuilding suppliers, Navy contractors, port operators and health organizations control access to defense, operational and patient data.
Suppliers need CMMC-aligned identity controls around CUI. Terminals need MFA and brokered vendor access under the Coast Guard's 2025 cyber rule. Cohash is headquartered in Frisco, Texas, serves Virginia Beach and the wider region remotely, and travels in for workshops and launches.
Cohash has no office in Hampton Roads. We work from Frisco, Texas, run Virginia Beach area projects remotely and travel in for discovery workshops, assessor prep and cutovers.
- rules
- Virginia breach notification, Va. Code §18.2-186.6Virginia medical information breach, Va. Code §32.1-127.1:05Virginia Consumer Data Protection ActCMMC Program, 32 CFR Part 170Coast Guard maritime cybersecurity, 33 CFR Part 101 Subpart F
What's specific about Virginia Beach
Each figure comes from a public source, linked on the card.
Newport News Shipbuilding, a division of HII, calls itself Virginia's biggest industrial employer, with more than 26,000 shipbuilders who design, build and maintain nuclear-powered aircraft carriers and submarines.
source ↗ 02Government makes up 164.5 thousand of the Virginia Beach-Norfolk-Newport News metro's 832.9 thousand nonfarm jobs, with manufacturing at 53.5 thousand, BLS reports for September 2026 (preliminary).
source ↗ 03 565,000The Port of Virginia cites an FY21 study finding it supports 565,000 Virginia jobs, and in June 2026 it announced the deepest harbor on the US East Coast.
source ↗ 04 35,000Sentara Health reports 12 hospitals in Virginia and northeastern North Carolina, 35,000 employees, and almost 1 million health plan members in Virginia and Florida.
source ↗Who we work with in Virginia Beach, and the rules they work under
-
Shipbuilding and ship repair suppliers
Subcontractors on overhaul and new construction work receive technical drawings and work packages that are often CUI. Accounts get created for a job and stay open long after it ends. We tie supplier access to contract or task order dates, require phishing-resistant MFA, and build the evidence trail for CMMC Level 2.
-
Navy and defense IT contractors
Firms supporting fleet, base and training programs run mixed networks with cleared staff, uncleared staff and shared admin tools. We separate privileged and daily identities, vault administrator credentials, and log every session into systems that hold controlled data.
-
Port terminals and logistics
Container terminals and the trucking and rail firms around them depend on gate systems, terminal software and vendor support links. We move remote vendor access onto named, time-limited sessions, give critical OT and IT separate credentials, and align controls with Coast Guard plan requirements.
-
Health systems and health plans
An integrated system that runs hospitals and a health plan carries both clinical and member identities, often in separate directories. We link them where policy allows, secure member portals against account takeover, and keep the access logs privacy and compliance teams rely on.
-
Virginia breach notification, Va. Code §18.2-186.6 ↗
Encryption is not a full safe harbor. A breach of encrypted data still counts if the person involved had access to the encryption key and the owner believes identity theft or fraud is likely. Notice goes to the Attorney General and affected residents.
-
Virginia medical information breach, Va. Code §32.1-127.1:05 ↗
Entities holding medical information that are not HIPAA covered entities or business associates must notify the Attorney General, the Commissioner of Health and affected residents of a breach without unreasonable delay, which can catch wellness apps and some employers.
-
Virginia Consumer Data Protection Act ↗
Effective 1 January 2023. Covered controllers must get consent before processing sensitive data, honor access, correction and deletion requests, and run data protection assessments for targeted advertising and other higher-risk processing.
-
CMMC Program, 32 CFR Part 170 ↗
Hampton Roads suppliers on DoD contracts started seeing CMMC self-assessment requirements in solicitations from 10 November 2025, and the requirements flow down to subcontractors handling CUI. Third-party Level 2 certification was due a year later, but the Department of War suspended it on 13 July 2026 pending a review.
-
Coast Guard maritime cybersecurity, 33 CFR Part 101 Subpart F ↗
Regulated terminals must enable account lockout, change default passwords, use MFA on remotely accessible OT and apply least privilege to admin accounts, documented in a Cybersecurity Plan. An annual Cybersecurity Assessment starts by July 2027.
Most requested in Virginia Beach
The services clients in Virginia Beach ask us for most.
01We're a ship repair subcontractor. Does CMMC flow down to us?
If you receive CUI or federal contract information under a DoD subcontract, the prime has to flow the requirement down, and the level matches the data you handle. Ask your prime which level your work needs, then scope the systems that touch that data.
02How do we stop supplier accounts from piling up after each overhaul?
Give every supplier account a sponsor and an end date tied to the task order, and send sponsors a short review before the date passes. Accounts nobody renews close automatically. That one change usually removes most of the stale access.
03Does the Virginia medical information breach law apply to a HIPAA-covered hospital?
Generally no. Section 32.1-127.1:05 excludes HIPAA covered entities and business associates that follow federal breach notice rules. It matters more for non-HIPAA businesses holding health information, such as some employers and consumer apps.
04Does the Coast Guard cyber rule cover our marine terminal?
If your facility already operates under a facility security plan under 33 CFR Part 105, the cyber subpart applies. We help with the account security measures and vendor access pieces of the Cybersecurity Plan and coordinate with whoever owns your facility security plan.
More cities in Virginia
d9fc11fe - 01Department of War, CMMC Phase II requirements suspended (July 2026)business.defense.gov ↗
- 02HII, Newport News Shipbuildinghii.com ↗
- 03BLS, Virginia Beach-Norfolk-Newport News economy at a glancebls.gov ↗
- 04The Port of Virginiaportofvirginia.com ↗
- 05Sentara Health, about ussentara.com ↗
- 06Va. Code §18.2-186.6law.lis.virginia.gov ↗
- 07Va. Code §32.1-127.1:05law.lis.virginia.gov ↗
- 08Virginia Consumer Data Protection Actlaw.lis.virginia.gov ↗
- 09Federal Register, CMMC program rulefederalregister.gov ↗
- 10Federal Register, DFARS CMMC acquisition rulefederalregister.gov ↗
- 11eCFR, 33 CFR Part 101 Subpart Fecfr.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it