Level 1 was the warm-up. Level 2 will test the whole military moving supply chain. Are you, your agents, and your vendors ready for CMMC?

CMMC For Movers — Vol. 1

Level 1 was the warm-up

March 15, 2026 came and went. Every TSP in the DP3 Household Goods program had to affirm CMMC Level 1, and most of our industry got there. Some got there comfortably. Some got there in a scramble.

Level 2 is a different animal. The deadline is March 1, 2027, and the bar moves from 15 basic safeguarding requirements to 110 security requirements. That is not a paperwork exercise. It reaches into how your people log in, where your shipment data lives, who can see it, how it travels between partners, and how you prove all of that after the fact. Most importantly, it impacts the entire moving supply chain: the TSPs that book the move from DPS, their agents, drivers, and vendors — claims adjusters, repair firms, software vendors, and more.

And the data in question is not abstract. It is service members’ names, addresses, orders, and family details. The government has been clear that it expects TSPs to handle Controlled Unclassified Information with care, and Level 2 is how that expectation gets measured. The government also has not offered a clear definition of CUI or when a piece of data combined with another piece of data becomes CUI.

Compliance is yours. Most of the controls live in your software.

Here is something every TSP should hear plainly: CMMC assesses organizations, not products. No software vendor can hand you a certificate. Your policies, your people, and your devices are part of the picture too.

But look at where your business actually runs. Logins, user permissions, audit trails, encryption, document and data exchange with agents, vendors, and partners. For most moving companies, the bulk of those controls live inside the systems they use every day. If that software was not built with CMMC in mind, you inherit the gap.

So the right question for any vendor is not “Are you CMMC compliant?” It is: “Which controls do you cover, and can you show me in writing?”

What we built in, so you don’t have to bolt it on

At EDC®, our answer is to build the security controls CMMC requires directly into the software our customers already use. EDC® CMMC Solutions are available across EasyDPS®, EDC-MoveStar®, EDC-AgentLink®, GOgistiX®, EDC Mobile™, and MERXED™. They include but are not limited to:

• Multi-factor authentication on every login
• Encryption of your data in transit and at rest
• Expanded audit logs, alerts, and monitoring so activity is recorded and reviewable
• Endpoint protection, installed, maintained, and monitored
• Secure messages and documents through GOgistiX®, keeping sensitive shipment data inside a protected network instead of external email
• A Customer Responsibility Matrix that shows exactly what EDC® covers and what remains yours, ready to support your own CMMC documentation

That last item matters more than it sounds. Level 2 lives and dies on documentation. Knowing precisely where your vendor’s responsibility ends and yours begins saves weeks of guesswork.

Much of this is already live across our platforms. The rest is on pace for completion by December 31, 2026, so our customers are covered before the Level 2 deadline arrives.

One integrated military moving supply chain

A military move is never one company’s job. The TSP books it. An origin agent packs it. A destination agent delivers it. A driver does the inventory and loads it. Billing companies, claims adjusters, and other partners touch it along the way. Every handoff is a place where a service member’s data can slip outside a protected environment — and too often that place is an email inbox.

The strongest protection is not a patchwork of tools. It is one integrated supply chain, where the data stays inside protected systems from the moment a shipment is accepted until the claim is closed:

• EasyDPS® is where military moves start. Its 24/7, two-way connection to DPS handles shipment acceptance and move updates automatically, and it is already in use by 99% of DoW-authorized SCACs.
• EDC-MoveStar® takes it from there as a complete, end-to-end move and operations management system: surveys, dispatch, crews, warehouse, claims, and financials in one place.
• GOgistiX® connects every partner in the chain. Since 2008 it has carried move data, documents, and status updates between movers, van lines, agents, forwarders, and partners — with more than 100 million documents exchanged inside an encrypted, secure network rather than open email. We are now building agent self-certification into GOgistiX® as well: agents can self-certify against defined criteria, TSPs can factor that status into their move distribution decisions, and additional tools will support the CMMC-required communication between TSPs and their agents.
• EDC-AgentLink® gives agents a secure way to accept shipments offered by TSPs, enter updates, complete digital inventories, and exchange documents. Agents act only within the role and restrictions the TSP assigns, and their data syncs with the TSP and with DPS.
• EDC Mobile™ puts inventories, e-forms, and signatures on the crew’s device and syncs completed documents back to the office and move partners.

Here is the practical part for TSPs: your agents do not have to be left outside the protected environment. They can be onboarded quickly onto EDC-AgentLink® or, if they need a full operating system of their own, EDC-MoveStar®. Whatever each partner’s own obligations turn out to be, giving them a secure way to work is the most practical protection the whole chain has.

Questions worth asking every software partner

Most TSPs run on more than one system, and agents often run on something else entirely. That is normal. But Level 2 makes it worth asking every vendor in your chain — including us — the same questions:

1. Which CMMC controls does your software cover, and is that documented in a Customer Responsibility Matrix I can hand to an assessor?
2. Has your company completed its own CMMC self-assessment, and is it registered in SPRS?
3. When shipment data leaves your system for an agent or partner, does it stay inside a protected environment, or does it travel by email?
4. How many separate systems does one military shipment pass through from DPS to delivery, and is each one covered?
5. How quickly can my agents be brought onto a secure platform?
6. Does your AI keep my data inside my environment, or send it to an outside provider?

The answers will tell you a lot. We are glad to answer every one of them.

We practice what we build

I would not ask our customers to do anything we have not done ourselves. EDC® completed its own CMMC Level 1 self-assessment, and our CMMC taskforce affirmed MET status for every required control. That affirmation is registered in SPRS, and our Level 2 documentation is already well underway.

We also represent, after reasonable inquiry, that our products and services use no equipment or services from the companies banned under NDAA Sections 889(a)(1)(A) and (B). And because MERXED™ processes data inside your own EDC® platform rather than sending it to outside AI providers, adding AI does not have to mean widening your compliance boundary.

Going through the process ourselves taught us what our customers are facing: the scoping questions, the documentation, the late nights. That experience is built into the software and into the support our team provides.

Everything is published in one place — our Trust Center — along with the official DoW guidance, scoping guides, and resources worth bookmarking.

Take another look before Level 2 takes a look at you

March 1, 2027 is closer than it sounds, especially once you account for peak season. If you already run EDC® software, these controls are part of your platform, and our team can walk you through the Customer Responsibility Matrix so you know exactly what is covered. If your agents are not yet on EDC-AgentLink® or EDC-MoveStar®, we can get them onboarded quickly. And if you have not looked at us in a while, this is a good time to.