CyberSheath’s new 2026 State of the DIB report found US defense contractors’ average Supplier Performance Risk System (SPRS) self-assessment score rose to +51, a five-year high, even as confidence in those scores’ accuracy fell sharply. The survey was published August 20, after the Pentagon paused the CMMC Phase II third-party audit plan in July 2026.
SPRS is how contractors self-score against NIST SP 800-171’s 110 controls under CMMC Phase I. This year, only 65% of respondents said they were extremely or very confident in their score, down from 89% last year and 94% in 2024, which means the number is rising just as faith in the number is eroding.
For DoD buyers and suppliers, that weakens what a good SPRS score can tell them about real controlled unclassified information posture: the reporting system still exists, but the assurance it provides is less settled than before.