Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · washington, dc

Federal buyers now want security measured continuously. Your identity logs are where that evidence starts.

Washington buys software and services under rules that keep moving. FedRAMP 20x swapped document packages for measured security indicators, and the Pentagon paused CMMC certification in July 2026 while keeping self-assessments in force. Contractors here need access controls they can prove on any given Tuesday.

Talk to an engineer
work in washington, dc7 services
4 local rules covered below
in short·20-second read

In Washington, DC we work with federal contractors, cloud and SaaS companies selling to agencies, associations and District government suppliers.

The work is identity and privileged access around controlled unclassified information, machine credentials and logging for FedRAMP 20x indicators, and governed data for AI projects. We map controls to NIST SP 800-171 and agency requirements. Cohash serves DC remotely from Frisco, Texas and flies in for workshops and launches.

Cohash has no office in the District. Our US base is Frisco, Texas. We work with DC organizations remotely and fly in for kickoff workshops, assessment readiness sessions and go-live weeks.

Ask an engineer facts checked 2026-10-21 · 8 sources
rules
DC breach notification, D.C. Code §28-3852FedRAMP 20xCMMC program and the July 2026 suspensionMayor's Order 2024-028, responsible AI in DC Government
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
washington, dc by the numbers

What's specific about Washington, DC

Each figure comes from a public source, linked on the card.

01 9.0%

Government accounted for 208.2 thousand of the District's 719.9 thousand nonfarm jobs in September 2026, preliminary BLS figures show. That government count was down 9.0% from twelve months earlier.

source ↗ 02 1,084

In the Washington-Arlington-Alexandria metropolitan division, professional and business services held 203.6 thousand of 1,084.8 thousand nonfarm jobs in September 2026 (preliminary) Education and health services followed at 171.2 thousand.

source ↗ 03

Information security analysts are concentrated in the DC metro at a location quotient of 3.36, against 1.17 for the average of the top 25 metros, according to JobsEQ data for 2024 Q3 cited by the Washington DC Economic Partnership.

source ↗ 04

On 12 February 2026 the District required every DC Government employee and contractor to finish responsible AI training within 90 days of notification. It builds on Mayor's Order 2024-028, the AI framework signed on 8 February 2024.

source ↗
who and what

Who we work with in Washington, DC, and the rules they work under

industries

  1. Defense and civilian agency contractors

    Integrators and subcontractors keep CUI in GCC High tenants, engineering file shares and ticketing tools, and staff move between contracts every few months. The access question an assessor or prime will ask is who could read which program's data last quarter. We tie group membership to contract roles, put admin rights behind just-in-time elevation and keep the audit trail SPRS affirmations rely on.

  2. Cloud and SaaS vendors selling to agencies

    Under FedRAMP 20x a provider proves security through measured indicators, so the evidence has to come straight out of your systems. We inventory service accounts, API keys and workload identities across the authorization boundary, rotate them on a schedule and export the results in a form your continuous monitoring reports can pull from.

  3. Associations, nonprofits and policy firms

    Membership groups run member portals, event platforms and donor CRMs that each grew their own login. Board members, volunteers and staff all overlap. We consolidate them under one customer identity layer with passkeys, separate staff admin roles from member accounts and clean the duplicate records sitting in the CRM.

  4. District agencies and their suppliers

    Vendors working for DC Government now sit inside an AI framework and a training mandate. When a contractor plugs an AI tool into agency data, someone has to scope its credentials and log what it reads. We set up that agent identity, its permissions and the review trail.

regulations

  1. DC breach notification, D.C. Code §28-3852 ↗

    Anyone doing business in the District who owns or licenses residents' personal data must notify them without unreasonable delay. If 50 or more DC residents are affected, the Attorney General gets written notice no later than residents do. Over 1,000 notices also triggers notice to the nationwide consumer reporting agencies.

  2. FedRAMP 20x ↗

    GSA's revised cloud authorization path. The Phase 2 Moderate pilot authorized its first cohort on 6 March 2026, and Phase 3 is formalizing the requirements. FedRAMP estimates it will stop accepting new Rev5 certifications on 11 June 2027, so check the dates again before you plan.

  3. CMMC program and the July 2026 suspension ↗

    On 13 July 2026 the Department of War suspended Phase 2 third-party Level 2 certification and later milestones, pending a review. Phase 1 self-assessments, SPRS scores and annual affirmations stay in place, as do DFARS 252.204-7012 and NIST SP 800-171 Rev. 2.

  4. Mayor's Order 2024-028, responsible AI in DC Government ↗

    Sets the District's framework for AI use across its agencies. Since February 2026, DC Government employees and contractors must complete responsible AI training within 90 days of being notified.

services

Most requested in Washington, DC

The services clients in Washington, DC ask us for most.

you are hereWashington, DC
01CMMC Phase 2 is suspended. Should we stop our Level 2 work?

We wouldn't. The self-assessment, the SPRS score and the yearly affirmation still apply, and DFARS 7012 still requires NIST SP 800-171 controls. An affirmation is a signed statement, so the access controls behind it need to be real. The review may change how certification works later. It does not remove the baseline.

02We are a SaaS company starting FedRAMP. Rev5 or 20x?

That depends on your agency sponsor, your impact level and the dates FedRAMP publishes, which it says may change. Ask your sponsor first. Either way the identity work is similar, with MFA, least privilege, machine credential inventory and logs you can query. 20x puts more weight on producing that evidence automatically.

03A vendor of ours had a breach. When does the DC Attorney General need to hear about it?

If you own the data and 50 or more District residents are affected, the AG's written notice is due no later than the notice to residents. The vendor's duty runs to you, the data owner. Have counsel confirm timing, since federal contract clauses and other states' laws may also apply.

04Can you set up identity for AI tools used on a District contract?

Yes. We give each AI agent or integration its own identity, scope it to the datasets the task needs and log its reads. Training compliance under the Mayor's framework stays with your HR and contract teams, but the access records help show the tool was used as approved.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 8 sources linked last checked 2026-10-21 content fingerprint 0267a70f
  1. 01BLS, District of Columbia economy at a glancebls.gov ↗
  2. 02BLS, Washington-Arlington-Alexandria metropolitan division economy at a glancebls.gov ↗
  3. 03Washington DC Economic Partnership, technology sectorwdcep.com ↗
  4. 04DC OCTO, responsible AI training release (February 2026)octo.dc.gov ↗
  5. 05D.C. Code §28-3852 (DC Council)code.dccouncil.gov ↗
  6. 06FedRAMP 20xfedramp.gov ↗
  7. 07GSA, FedRAMP program overviewgsa.gov ↗
  8. 08WilmerHale, Pentagon suspends CMMC Phase 2 requirements (July 2026)wilmerhale.com ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it