Following the Pentagon’s pause of third-party audit mandates for US defense industrial base (DIB), some contractors say they can’t trust their own cybersecurity scores.
According to the 2026 State of the DIB Report, a new study published on August 20 by CyberSheath, the average Supplier Performance Risk System (SPRS) score rose to a five-year high of +51, up from +33 in 2025, which was the first positive score in the report’s history.
SPRS is the framework used by US defense contractors to self-assess their cybersecurity maturity under the Cybersecurity Maturity Model Certification (CMMC).
CMMC is a program designed to enhance cyber hygiene for US defense contractors and subcontractors handling federal contract information (FCI) and controlled unclassified information (CUI) for the Department of Defense (DoD).
Defense contractors who wish to secure a DoD contract must comply with the Defense Federal Acquisition Regulation Supplement (DFARS), the official DoD rulebook that turns CMMC into a binding legal contract requirement.
Using SPRS, DIB contractors and subcontractors assess their maturity against 110 security controls referred to in NIST SP 800-171, a standard published by the US National Institute of Standards and Technology (NIST). A perfect assessment score is 110.
While this self-reporting is currently the only mandate under Phase I of the CMMC program, a second phase was about to introduce independent assessments led by Certified Third-Party Assessment Organizations (C3PAOs) to verify compliance.
Originally scheduled to come into effect on November 10, 2026, CMMC Phase II was suspended by the Trump administration in July 2026.
Confidence in Self-Assessment Cybersecurity Scores Drops Sharply
Despite showing record-high self-assessment scores, the CyberSheath study also revealed a more concerning trend: confidence in these scores’ accuracy fell 24 percentage points.
The survey, conducted by Merrill Research and underpinning the study, found that just 65% of contractors said they were extremely or very confident their score was accurate – down sharply from 89% last year and 94% in 2024.
David M. Schneer, CEO of Merrill Research, described the gap between reported self-reporting cybersecurity score progress and confidence in that progress as “the most striking finding this year.”
“Contractors are reporting higher SPRS scores and greater adoption of important cybersecurity capabilities, but confidence in the accuracy of those scores has fallen substantially. That tension suggests that measuring progress requires looking beyond the reported score itself,” he said.
What’s more, only 1% of contractors believe they are completely prepared for CMMC certification, unchanged from a previous CyberSheath study published in October 2025.
Defense Contractors Call for Easier CMMC Compliance Processes
The main bottleneck doesn’t seem to be financial, with 53% of respondents saying their budgets felt “just right,” while 24% said they were more than enough.
DFARS compliance budgets were found to have rose sharply this year to an average of $155,204 annually.
“The findings suggest that the challenge facing the DIB is not simply how much contractors spend on cybersecurity, but how effectively those investments translate into implemented, sustainable and verifiable security,” said the CyberSheath report.
Additionally, the study showed that while more than half (52%) of DIB members fear of losing contracts because of non-compliance, most (90%) are still in favor of a legal mandate for minimum cybersecurity standards for defense contractors and subcontractors.
While a majority (77%) said DFARS compliance meaningfully improves national security, contractors are also calling for changes to how it’s implemented, with 74% asking for easier implementation processes and 70% for more vendor options to support compliance efforts.
Emil Sayegh, CEO of CyberSheath, highlighted that most DIB contractors are manufacturers, engineers and specialized businesses “whose mission is supporting the warfighter, not becoming cybersecurity experts.”
He called for the federal administration to reform the CMMC program in a way that “makes effective cybersecurity easier to consume while preserving objective, verifiable assurance that the protections are actually in place and working.”
“However, CMMC evolves, meaningful verification and accountability should remain central to ensuring that reported compliance reflects operational cybersecurity,” he concluded.
The 2026 State of the DIB Report is based on a survey of 302 US defense contractors (195 prime contractors, 118 subcontractors, and 11 organizations identifying as both), conducted by Merrill Research in May 2026.
