Recent surveys reveal a significant gap between defense contractors’ confidence in their cybersecurity measures and their ability to substantiate these claims. Despite a strong belief in self-reported compliance scores, many contractors lack the necessary documentation to support these assertions.
Survey Insights on Cybersecurity Compliance
A survey conducted by Kiteworks examined 273 defense contractors following the Pentagon’s halt of the CMMC 2.0 Phase 2 third-party assessments. A striking 96% of these contractors expressed confidence in their Supplier Performance Risk System (SPRS) scores. However, merely 29% could provide both a current SPRS submission and a FedRAMP-authorized platform to validate their claims.
Kiteworks assessed contractors’ readiness by combining compliance maturity with their response to the suspension. This resulted in a combined score of 60 out of 100, highlighting a significant shortfall compared to an expected average of 77. Notably, nearly a third of respondents scored poorly on both measures simultaneously.
Legal Implications and Contractor Concerns
Despite the suspension, contractors remain legally obligated under DFARS to ensure accurate attestations, a concern shared by 84% of respondents worried about False Claims Act liabilities. Additionally, 92% have sought legal or compliance reviews to mitigate risks.
Alarmingly, almost half of the surveyed contractors were unaware that Phase 1 self-assessment requirements persisted during the pause. This knowledge gap was consistent across those who were ‘very confident’ and those ‘somewhat confident’ about the changes.
Market Reactions and Future Outlook
The market has adjusted to the changes, with 55% of contractors now pursuing projects previously avoided due to CMMC Level 2 requirements. However, this has also led to 52% withdrawing from bids and 38% losing contracts due to compliance challenges. Smaller subcontractors, in particular, have been affected, with a notable 55% experiencing bid losses.
Another report, the 2026 State of the DIB Report, highlighted a similar disconnect between confidence and preparedness. Although the average SPRS score reached a five-year high, contractors’ confidence in these scores’ accuracy has declined significantly.
Looking ahead, contractors emphasize the importance of independent verification within the compliance process. Kiteworks found that 93% of respondents support third-party authorization, and many anticipate a modified return of Phase 2.
As the conversation around cybersecurity compliance continues, industry leaders stress the need for reforms that simplify the process while maintaining robust, verifiable security measures.
