New Kiteworks Study Reveals Defense Contractors Aren’t Ready for CMMC Compliance

Early industry post-suspension survey reveals 96% of DIB contractors are confident they’d pass a CMMC audit; 30% can prove it.

SAN MATEO, CA, UNITED STATES, August 20, 2026 /EINPresswire.com/ — Kiteworks, which empowers organizations to ensure regulatory compliance and manage risk across every exchange of sensitive data, today released its 2026 “State of CMMC 2.0 Preparedness in the DIB,” the first report to benchmark the readiness of the Defense Industrial Base (DIB) since the Department of War suspended CMMC 2.0 Phase II third-party assessments on July 13, 2026. Based on a survey of 273 defense contractors fielded in the days after the announcement, the report finds the opposite – and surfaces a readiness gap the suspension did not create so much as uncover.

According to the survey findings, 98% of organizations took at least one concrete action in response to the suspension, and only 2% did nothing. The market did not pause. It kept investing in compliance.

The unsettling finding sits underneath that activity. 96% of contractors say they are confident their self-attested Supplier Performance Risk System (SPRS) score would hold up under review. Follow that same confident group one step at a time, and it thins fast: only 60% have a current SPRS submission, only 36% run on a FedRAMP-authorized platform, and just 29% can point to both. Ultimately, fewer than three in ten organizations that consider themselves “audit-ready” have the key components in place to accurately make the claim.

To measure readiness by evidence rather than by feel, the report introduces two indices built directly from the survey: a CMMC Compliance Maturity Score (CCMS), averaging 78.2 of 100, and a Suspension Governance Score (SGS), averaging 74.9. Multiplied rather than averaged – because a strong compliance record cannot compensate for a passive response, and a busy response cannot compensate for a weak foundation – they produce a combined CMMC Suspension Readiness Index (CSRI) of 60.0, well below the roughly 77 a simple average would suggest. The largest single group, 31% of this already-qualified population, scores low on both dimensions at once.

“The headline is that the DIB did not wait, and that is real,” said Frank Balonis, Field CISO, Kiteworks. “The finding that matters is the distance between confidence and evidence. When you multiply the two halves of readiness instead of averaging them, the score drops from 77 to 60, and a quarter of an already-qualified base lands in the exposed corner. That is arithmetic, not opinion, and it is exactly the part a self-assessment score would never show you.”

The gap carries legal weight. DFARS clause 252.204-7012 never paused; the suspension removed the third-party check on self-attestation, not the obligation to attest accurately. In the survey, 84% of contractors say they are concerned about False Claims Act exposure from an inaccurate self-attested score, and 92% have already engaged legal or compliance review. Even so, 80% of the weakest-compliance organizations remain confident their score would hold up – confidence detached from the underlying state.

The survey also found that confidence does not track knowledge. 48% of contractors do not know that Phase 1 self-assessment obligations continue during the pause, and respondents who called themselves “very confident” in their understanding averaged 2.48 out of 4 on a factual test of what the suspension changed – identical to the 2.48 averaged by those who called themselves only “somewhat confident.

The market is already moving on the signal. 55% of contractors are now bidding on work they previously would have avoided over CMMC Level 2 requirements, while 52% have withdrawn from a DOW bid and 38% report losing or being disqualified from a contract over the same requirement. The losses fall hardest on the least-leveraged tier: Tier 2 and lower subcontractors report a bid loss at 55%, nearly double the 31% rate among prime contractors.

“Contractors did the work. What most cannot do yet is prove it on demand,” said Patrick Spencer, SVP of Americas Marketing and Industry Research at Kiteworks. “A pause in assessments is not a pause in accountability. Government audits are still running, the False Claims Act still applies, and the record the government relies on is the score already on file. The organizations that come through this window in the strongest position are the ones treating it as time to generate defensible, audit-ready evidence – not as permission to coast.”

Demand is shifting accordingly: 89% of contractors are already using or plan to adopt a FedRAMP-authorized platform within six months (a CMMC requirement), and 93% say independent third-party authorization will be essential or important to future vendor selection. 93% also plan to comment on the Department of War’s Request for Information, and 58% expect Phase II to return in a modified form.

Get the full report and join the discussion here.

Register for the upcoming webinar, “The CMMC 2.0 Suspension: What Your Peers Did Next,” a moderated discussion with CMMC experts on September 2, 2026, at 9 AM PDT.

About Kiteworks
Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies.

David Schutzman
Kiteworks
+1 203-550-8551
email us here
Visit us on social media:
LinkedIn
Facebook
YouTube
TikTok
X

Media gallery