Policy & Regulation
CyberSheath Survey Shows SPRS Scores Losing Trust CyberSheath’s new 2026 State of the DIB report found US defense contractors’ average Supplier Performance Risk System (SPRS) self-assessment score rose to +51, a five-year high, even as confidence in those scores’ accuracy fell sharply. The survey was published August 20, after the Pentagon paused the CMMC Phase II third-party audit plan in July 2026.
SPRS is how contractors self-score against NIST SP 800-171’s 110 controls under CMMC Phase I. This year, only 65% of respondents said they were extremely or very confident in their score, down from 89% last year and 94% in 2024, which means the number is rising just as faith in the number is eroding.
For DoD buyers and suppliers, that weakens what a good SPRS score can tell them about real controlled unclassified information posture: the reporting system still exists, but the assurance it provides is less settled than before.
4 sources · Aug 21
Timeline Sources Aug 21 Industrial Cyber
CyberSheath report finds growing credibility gap in CMMC compliance as contractor confidence falls - Industrial Cyber
CyberSheath report finds growing credibility gap in CMMC compliance as defense contractors report higher scores but declining confidence.
original Aug 21 Cybersecurity Dive
Defense contractors still struggling with basic CMMC requirements
A “confidence disconnect” is plaguing the industry, a consulting firm said.
original Aug 21 SecurityWeek
Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind
Two industry surveys released this week by Kiteworks and CyberSheath paint a consistent picture of the defense industrial base.
original Part of the PlainSec briefing for 2026-08-22
Every edition of this story: CyberSheath Survey Shows SPRS Scores Losing Trust
More from today Policy & Regulation
CyberSheath Survey Shows SPRS Scores Losing Trust CyberSheath’s new 2026 State of the DIB report found US defense contractors’ average Supplier Performance Risk System (SPRS) self-assessment score rose to +51, a five-year high, even as confidence in those scores’ accuracy fell sharply. The survey was published August 20, after the Pentagon paused the CMMC Phase II third-party audit plan in July 2026.
SPRS is how contractors self-score against NIST SP 800-171’s 110 controls under CMMC Phase I. This year, only 65% of respondents said they were extremely or very confident in their score, down from 89% last year and 94% in 2024, which means the number is rising just as faith in the number is eroding.
For DoD buyers and suppliers, that weakens what a good SPRS score can tell them about real controlled unclassified information posture: the reporting system still exists, but the assurance it provides is less settled than before.
4 sources · Aug 21
Timeline Sources Aug 21 Industrial Cyber
CyberSheath report finds growing credibility gap in CMMC compliance as contractor confidence falls - Industrial Cyber
CyberSheath report finds growing credibility gap in CMMC compliance as defense contractors report higher scores but declining confidence.
original Aug 21 Cybersecurity Dive
Defense contractors still struggling with basic CMMC requirements
A “confidence disconnect” is plaguing the industry, a consulting firm said.
original Aug 21 SecurityWeek
Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind
Two industry surveys released this week by Kiteworks and CyberSheath paint a consistent picture of the defense industrial base.
original Part of the PlainSec briefing for 2026-08-22
Every edition of this story: CyberSheath Survey Shows SPRS Scores Losing Trust
More from today