Policy · 53 days ago
CyberSheath’s new 2026 State of the DIB report found US defense contractors’ average Supplier Performance Risk System (SPRS) self-assessment score rose to +51, a five-year high, even as confidence in those scores’ accuracy fell sharply. The survey was published August 20, after the Pentagon paused the CMMC Phase II third-party audit plan in July 2026.
SPRS is how contractors self-score against NIST SP 800-171’s 110 controls under CMMC Phase I. This year, only 65% of respondents said they were extremely or very confident in their score, down from 89% last year and 94% in 2024, which means the number is rising just as faith in the number is eroding.
For DoD buyers and suppliers, that weakens what a good SPRS score can tell them about real controlled unclassified information posture: the reporting system still exists, but the assurance it provides is less settled than before.
4 sources covering this story
CyberSheath report finds growing credibility gap in CMMC compliance as defense contractors report higher scores but declining confidence.
Defense contractors still struggling with basic CMMC requirements
A “confidence disconnect” is plaguing the industry, a consulting firm said.
Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind
Two industry surveys released this week by Kiteworks and CyberSheath paint a consistent picture of the defense industrial base.
US Defense Contractors Admit Their CMMC Scores May Not Be Accurate
Defense contractors in the US are doubting their own self-assessment scores under CMMC Phase I, even as those scores hit an all-time high
Part of the PlainSec briefing for 2026-08-24