TSPs working with the Department of Defense are now subject to Cybersecurity Maturity Model Certification (CMMC) rules.
Transportation service providers (TSPs) seeking contracts with the U.S. Department of Defense have defined cybersecurity implementation requirements.
TSPs working with the DOD are now subject to Cybersecurity Maturity Model Certification (CMMC) rules. CMMC is the DOD’s unified cybersecurity standard to better protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) shared with contractors and subcontractors.
CMMC establishes a set of practices and processes organized into three levels, each reflecting an increasing degree of cybersecurity sophistication.
For TSPs, CMMC is especially important because they routinely handle sensitive shipment and personnel information data that, if compromised, could put national security and individual privacy at risk. Compliance with the required CMMC level helps TSPs have the proper safeguards in place to prevent, detect, and respond to cyber threats.
Key CMMC levels relevant to transportation service providers (TSPs)
CMMC Level 1 (Basic cyber hygiene)
This foundational level requires TSPs to implement basic cybersecurity practices, such as using antivirus software, securing passwords, and controlling physical access to sensitive information. These measures focus on protecting Federal Contract Information (FCI) and are designed to thwart common, low-level cyber threats.
CMMC Level 2 (Intermediate cyber hygiene)
Level 2 introduces more comprehensive requirements, including documenting cybersecurity policies and procedures, and additional controls to safeguard Controlled Unclassified Information (CUI). TSPs are expected to demonstrate a more consistent and proactive approach to cybersecurity, bridging the gap between basic hygiene and more advanced practices.
How CLA can help TSPs with CMMC compliance
Gap analysis and readiness assessments
CLA can work with TSPs to identify gaps and assess readiness of both level 1 and level 2 CMMC control implementation.
Policy and documentation support
CLA can help TSPs create and update system security plans, cybersecurity policies, incident response plans, and access control procedures, providing the required evidence and documentation to demonstrate CMMC Level 2 compliance.
Assessments
Conducting regular system assessments and penetration testing can help TSPs identify and address security gaps, keeping their practices in line with the evolving standards of both Level 1 and Level 2.
For more information
The DOD is hosting a CMMC workshop for approved TSPs on January 14, 2026, at 1 p.m. CST. RSVP by January 5 to transcom.scott.tcj9.mbx.ppcf@mail.mil to attend.