CyberSheath report finds credibility gap in CMMC compliance as contractor confidence falls

Defence contractors are reporting higher cybersecurity maturity scores but losing faith in those scores, according to a new report from CyberSheath. The 2026 State of the DIB Report, based on a survey of 302 US defence contractors, found that the average Supplier Performance Risk System (SPRS) score rose to +51, up from +33 in 2025, yet confidence in score accuracy fell 24 percentage points to 65%. Only 1% of contractors believe they are completely prepared for CMMC certification.

The credibility gap stems partly from the Pentagon’s July decision to suspend third-party verification of CMMC compliance, shifting to self-attestation. CyberSheath CEO Emil Sayegh said that while CMMC reform should make effective cybersecurity easier to consume, meaningful verification and accountability should remain central to ensuring reported compliance reflects operational security.

The survey also found that DFARS compliance budgets rose to an average of $155,204 annually, and 90% of contractors still want the federal government to mandate minimum cybersecurity standards for all federal contractors.