Redspin

75% of defense contractors say achieving CMMC Level 2 certification provides value beyond contract eligibility.

68.8% of defense contractors cite independent cybersecurity validation as a reason achieving CMMC Level 2 provides value.

58.3% of defense contractors cite improved cyber posture as a reason achieving CMMC Level 2 provides value.

14% of Defense Industrial Base members are considering using a cloud service provider for Cybersecurity Maturity Model Certification compliance in the future.

26% of Defense Industrial Base members reported spending between $100,000 and $250,000 on Cybersecurity Maturity Model Certification preparation as of November 2025.

68% of Defense Industrial Base members reported that preparing for Cybersecurity Maturity Model Certification has taken them over a year as of November 2025.

78.2% of organizations continue progressing toward CMMC certification or are already Level 2 certified by a third party.

21.9% of organizations delay CMMC certification or significantly slow implementation and certification efforts.

20.3% of organizations paused spending on CMMC certification.

23.3% of prime contractors relaxed Phase 2 CMMC requirements for their subcontractors.

39.5% of prime contractors are still deciding whether to relax Phase 2 CMMC requirements for their subcontractors.

76.6% of subcontractors report not receiving any communication from their prime about the Phase 2 pause.

10.6% of subcontractors say their prime paused CMMC requirements.

100% of organizations that pause spending on NIST SP 800-171 consulting, SOC/SIEM/MSP services, or cloud platforms also pause or slow their CMMC efforts.

62.5% of defense contractors cite commitment to protecting Controlled Unclassified Information (CUI) as a reason achieving CMMC Level 2 provides value.

3.1% of organizations decreased spending on CMMC certification.

47% of Defense Industrial Base members have received flow-down requests from prime contractors regarding Cybersecurity Maturity Model Certification.

54% of Defense Industrial Base members reported starting their Cybersecurity Maturity Model Certification journey with a strong implementation of NIST 800-171 standards and DFARS controls.

37% of Defense Industrial Base members are not scheduled for a Cybersecurity Maturity Model Certification assessment or are unsure of their next steps.

53% of Defense Industrial Base members are currently using a cloud service provider to minimize their Cybersecurity Maturity Model Certification scope.

60% of Defense Industrial Base members reported an increase in training staff on cybersecurity since last year, up from 37% .

31% of Defense Industrial Base members reported spending more than $250,000 on Cybersecurity Maturity Model Certification preparation as of November 2025.