Trust Center

After completing the Cybersecurity Maturity Model Certification (CMMC) Level 1 self-assessment for EDC®, our CMMC Taskforce has affirmed MET status (the highest Level 1 affirmation) for all required security controls as outlined in FAR clause 52.204-21(b)(1) and as referenced in the 2026 Defense personal Property Program (DP3) Household Goods Tender of Service A.2(c). This assessment status is registered within SPERS/PIEE, and EDC® is already advancing on documenting our Level 2 assessment, and will continue to communicate updates.

For those of you who work in the Defense Personal Property Program (DP3) Household Goods (HHG) program and who fall under the requirement for CMMC Level 1 affirmation with deadline of 15 MARCH 2026 (further details available in the Tender of Service (ToS) - https://tinyurl.com/DP3-2026ToS, your EDC® software’s user and access control features, logs, as well as other functionality, can support related questions within your own Level 1 self-assessment in those related requirements when utilized accordingly and when working within your EDC® software.

Section 1286: foreign institutions of concern

Section 1286 of the FY19 NDAA directs the Department of War to publish and maintain a list of foreign academic and research institutions that engage in problematic activities — conduct that raises the risk of U.S. government-funded research and development being misappropriated. On July 23, 2026, the Department published the FY25 update, which identifies 130 institutions located in China, Russia, and Iran. The Department advises strict caution for domestic researchers, academic institutions, and industry partners considering collaboration, funding, or data-sharing arrangements with any listed institution, and will update the list at least annually.

After conducting a reasonable inquiry, Enterprise Database Corporation (EDC®) hereby represents that its products and services do not use software, hardware, or services from the following Chinese technology companies (and their subsidiaries or affiliates) banned under NDAA sections 889 (a)(l)(A) and 889 (a)(l)(B): Huawei Technologies Company; ZTE Corporation; Hytera Communications Corporation; Hangzhou Hikvision Digital Technology Company; and Dahua Technology Company.

Additionally, EDC® hereby represents that it does not engage in or fund any research projects with the Chinese, Iranian, or Russian Institutions or Recruiting firms included in the NDAA Section 1286 List.

EDC® has partnered with IdenTrust to provide EasyDPS® customers identity proofing and issuance of Department of Defense (DoD) External Certificate Authority (ECA) certificates for EasyDPS® Customers using the Department of War DPS System.  

IdenTrust offers discounted pricing for EasyDPS® customers per the agreement between IdenTrust and Enterprise Database Corporation. Per current government requirements, each employee that accesses DPS needs one certificate regardless of the number of ETA logins associated with that certificate. Additionally, RPA accounts used by EasyDPS® to access DPS require digital certificates. IdenTrust

The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, establishes national standards for protecting the privacy and security of individuals' health information in the United States. It applies to covered entities—such as healthcare providers, health plans, and healthcare clearinghouses—as well as their business associates, requiring administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of protected health information (PHI). Organizations that handle PHI must implement appropriate access controls, encryption, audit controls, and breach notification procedures to remain compliant.

Enterprise Database Corporation (EDC®) is committed to protecting the privacy and security of protected health information (PHI) entrusted to us by our healthcare revenue management customers. As a business associate under the Health Insurance Portability and Accountability Act (HIPAA), EDC® maintains administrative, physical, and technical safeguards designed to ensure the confidentiality, integrity, and availability of PHI, consistent with the HIPAA Security and Privacy Rules. We execute Business Associate Agreements (BAAs) with applicable customers to formalize our shared compliance responsibilities.