Two surveys conducted by Kiteworks and CyberSheath in 2026 highlight a disconnect in the defense industrial base regarding Cybersecurity Maturity Model Certification (CMMC) compliance. Following the Pentagon's suspension of CMMC 2.0 Phase 2 third-party assessments, 96% of surveyed contractors expressed confidence in their self-attested SPRS scores, but only 29% could substantiate these with both current SPRS submissions and FedRAMP-authorized platforms. The suspension did not pause contractors' legal obligations to attest accurately, with 84% concerned about False Claims Act liability. Nearly half of respondents were unaware that Phase 1 self-assessment requirements continued. The market reacted with increased bidding on contracts previously avoided due to CMMC Level 2 requirements, but also with significant bid losses, especially among Tier 2 and lower subcontractors. CyberSheath's earlier survey showed rising SPRS scores but declining confidence in their accuracy and minimal preparedness for certification. Contractors increased spending on DFARS compliance and adoption of core security technologies. Both surveys indicate strong contractor support for independent third-party verification and government-mandated minimum cybersecurity standards, alongside calls for easier implementation and more vendor options. The findings underscore a significant gap between perceived compliance confidence and verifiable evidence.

The suspension of CMMC Phase 2 third-party assessments has not relieved contractors of their legal obligations to accurately attest compliance, exposing them to potential False Claims Act liability. The discrepancy between high confidence and low ability to prove compliance may lead to increased legal and contractual risks. Smaller subcontractors face disproportionate challenges, including bid losses and disqualifications, potentially impacting the defense supply chain. The gap in verifiable compliance evidence could undermine trust in contractor cybersecurity postures and affect future contract awards. Increased compliance spending and technology adoption indicate resource allocation toward meeting requirements, but low preparedness for certification suggests ongoing vulnerability to compliance failures.

Since the Pentagon has suspended CMMC Phase 2 third-party assessments, contractors must continue to meet their legal obligations to accurately self-attest compliance under DFARS. Contractors should ensure current SPRS submissions and utilize FedRAMP-authorized platforms where possible to substantiate compliance claims. Legal and compliance reviews are advisable to mitigate False Claims Act liability. Contractors should stay informed about potential modifications to CMMC Phase 2 and participate in government requests for information. Emphasis should be placed on achieving verifiable proof of compliance while advocating for streamlined implementation and expanded vendor options. No official fix or patch applies as this is a compliance and procedural issue rather than a software vulnerability.