DoD Considers CMMC Level 2 Rules for Military Moving Firms

The Department of Defense (DoD) is considering rules that could increase Cybersecurity Maturity Model Certification (CMMC) Level 2 expectations for firms handling military moves. The rules remain proposed, so this development does not establish a new compliance mandate currently in effect. Companies supporting DoD moving requirements should distinguish the potential future standard from existing contractual and regulatory obligations while tracking any formal rulemaking or procurement documents that clarify applicability.

For moving contractors and prospective bidders, the signal is a reason to assess cybersecurity readiness—not evidence of a specific new solicitation. Firms can review how they protect covered information, identify gaps against relevant CMMC Level 2 expectations, and consider whether remediation, documentation, or assessment preparation may be needed if the proposal advances. Because no contract value, bid deadline, or procurement vehicle is specified, contractors should avoid treating the update as a confirmed opportunity or assuming that every military-moving requirement will carry the same terms.

The broader update also references separate developments at the Office of Personnel Management (OPM), the Department of Veterans Affairs (VA), and the U.S. Census Bureau. OPM is directing agencies to remind employees of protections for reporting suspected misconduct. VA plans to hire more than 2,000 claims processors in 2027, while the Census Bureau is researching automated business-survey data collection. These items provide federal workforce and operational context, but the available information does not identify procurements connected to the hiring plan or research effort.

The procurement takeaway is to monitor the DoD proposal and any subsequent acquisition language for explicit CMMC requirements, scope, timing, and verification procedures. Moving firms should map their current cybersecurity posture to applicable requirements and maintain a clear distinction between proposed policy and enforceable obligations. In parallel, vendors following VA staffing or Census data-collection developments should look for later notices, budget details, or solicitations before drawing conclusions about contract demand. The source material does not provide additional rule text, implementation dates, or named vendors, so those details remain unconfirmed.

• DoD is considering proposed rules that could increase CMMC Level 2 expectations for firms handling military moves.
• The rules are proposed; the signal does not establish a new compliance requirement currently in effect.
• Moving contractors should review cybersecurity capabilities against relevant CMMC Level 2 expectations and monitor formal updates.
• No solicitation, contract value, procurement deadline, or specific contract opportunity is identified.
• OPM is directing agencies to remind employees about protections for reporting suspected misconduct.
• VA plans to hire more than 2,000 claims processors in 2027; no related procurement is specified.
• The U.S. Census Bureau is researching automated business-survey data collection; the signal identifies no associated solicitation.
• Treat the developments as policy, workforce, and research signals unless subsequent acquisition documents confirm a procurement requirement.