The Cybersecurity Maturity Model Certification (CMMC) is DoD’s standardized framework for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) data when it resides in federal contractor and subcontractor systems. In DP3, the information handled by TSPs and their subcontractors includes such data.

This applies to all TSPs, domestic and international agents, storage facilities, OA/DA and hauling agents, crating companies, IT vendors, subcontracted labor and service providers, freight forwarders, claims service providers, and any entity having access to FCI and CUI data in support of DP3. If you touch DP3 shipment information, you are part of the cybersecurity chain of custody.

FCI - Federal Contract Information (FCI) means information, not intended for public release, that is provided by or generated for the Government under the ToS to develop or deliver a service to the Government. It does not include information provided by the U.S. Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

CUI - Controlled Unclassified Information (CUI) means information the U.S. Government creates or possesses, or information an entity creates or possesses for or on behalf of the U.S. Government, that a law, regulation, or U.S. Government wide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

 Update 1/30/26:  The Permanent Change of Station Joint Task Force (PCS JTF) provided an update to Advisory #26-0025 via Advisory #26-0025B.

Of note, the main change is the addition of paragraph 2.d., which includes an update on providing the CMMC Unique Identifier (UID) to the appropriate TRANSCOM Quals organization email address NLT 15 March. The advisory states: