Defense contractors are reporting their highest cybersecurity compliance scores since tracking began, but confidence in the accuracy of those scores has fallen sharply, according to an annual study conducted by Merrill Research and commissioned by CyberSheath, a cybersecurity compliance services provider.
The study, which surveyed 302 defense contractors, found that average Supplier Performance Risk System (SPRS) scores climbed to plus 51 in 2026, up from plus 33 last year. At the same time, just 65% of contractors that submitted an SPRS score said they were extremely or very confident in its accuracy, down from 89% last year and 94% in 2024.
SPRS scores measure contractor compliance with National Institute of Standards and Technology (NIST) Special Publication 800-171 security requirements. Those requirements also form the cybersecurity foundation for the Department of Defense’s (DOD) Cybersecurity Maturity Model Certification (CMMC) program.
CMMC provides a framework for DOD to verify that defense industrial base (DIB) contractors meet applicable cybersecurity requirements, including through self-assessments and, for some contractors, third-party assessments.
According to the report, the latest SPRS results show substantial improvement on paper. The average score had remained negative for three consecutive years, at minus 12 in 2024, minus 15 in 2023, and minus 25 in 2022. SPRS scores can range from minus 203 to a maximum of plus 110.
The scores do not represent all respondents, however. Only 67% said they had submitted an SPRS score.
The study characterized the disconnect between higher scores and lower confidence as a “central challenge for the DIB,” saying the issue is increasingly about “independently validating whether claimed compliance reflects operational reality.”
The report’s findings come as DOD has paused Phase 2 of CMMC, which had been scheduled to take effect on Nov. 10. The department announced a 60-day review of the program on July 13 while keeping Phase 1 requirements in place.
Under Phase 1, contractors handling certain federal contract information remain subject to self-assessment requirements. Phase 2 was set to expand implementation of CMMC and introduce third-party assessments for contractors handling certain controlled unclassified information.
Among contractors in the study that had undergone a third-party assessment, 63% said they passed on their first attempt. Nearly all – 97% – used a managed services provider or advisory firm to prepare for the assessment, and in 74% of cases, that outside support supplemented in-house work rather than replacing it.
Beyond assessment outcomes, the study found that contractors reported less difficulty understanding CMMC and NIST SP 800-171 requirements.
Forty percent rated the difficulty of understanding those requirements at an eight, nine, or 10 on a 10-point difficulty scale, down from 52% last year and 54% in 2024.
Despite that decline in reported difficulty, contractors did not report comparable levels of CMMC preparedness. They rated themselves an average of 70% ready for CMMC certification. Only 32% said they were at least 80% prepared. Just 1% said they were completely ready.
The CMMC pause comes amid a broader debate over whether the program’s implementation costs and administrative requirements have become too burdensome, particularly for smaller defense contractors.
In announcing its review, DOD said that CMMC, while intended to improve cybersecurity across the defense supply chain, had created prohibitive compliance costs and administrative burdens for some companies.
The department cited Small Business Administration estimates that put compliance costs at $593,800 per certification for small businesses requiring a third-party assessment and about $388,600 for those eligible for self-assessment.
The study, meanwhile, found that contractors reported spending an average of $155,204 annually on cybersecurity. The report noted the difference between that figure and the SBA estimates but acknowledged they are not directly comparable: The SBA estimates apply to certification costs for small businesses, while the study measures annual cybersecurity spending among contractors of varying sizes.
According to the survey, 53% of contractors said their current cybersecurity budget is the right amount, while 68% expect their budgets to increase over the next year.
Those findings suggest that cybersecurity investment itself is not the primary obstacle to cybersecurity compliance, the report notes.
“Rather, organizations continue to struggle with navigating evolving requirements, producing the evidence necessary to support executive attestation, and demonstrating compliance in a way that customers, regulators, and contracting officers can trust,” the report states.
As DOD considers the future of CMMC, the findings suggest contractors are looking for ways to reduce the compliance burden rather than weaken cybersecurity requirements. Seventy-four percent said they want easier implementation, while 70% want more vendor options.
“In other words, contractors support the objective. They just want the journey to be less burdensome,” the report states.