Committed to the Mission: The State of the DIB with CMMC in Flux

75% of defense contractors say achieving CMMC Level 2 certification provides value beyond contract eligibility.

68.8% of defense contractors cite independent cybersecurity validation as a reason achieving CMMC Level 2 provides value.

58.3% of defense contractors cite improved cyber posture as a reason achieving CMMC Level 2 provides value.

78.2% of organizations continue progressing toward CMMC certification or are already Level 2 certified by a third party.

21.9% of organizations delay CMMC certification or significantly slow implementation and certification efforts.

20.3% of organizations paused spending on CMMC certification.

23.3% of prime contractors relaxed Phase 2 CMMC requirements for their subcontractors.

39.5% of prime contractors are still deciding whether to relax Phase 2 CMMC requirements for their subcontractors.

76.6% of subcontractors report not receiving any communication from their prime about the Phase 2 pause.

10.6% of subcontractors say their prime paused CMMC requirements.

100% of organizations that pause spending on NIST SP 800-171 consulting, SOC/SIEM/MSP services, or cloud platforms also pause or slow their CMMC efforts.

62.5% of defense contractors cite commitment to protecting Controlled Unclassified Information (CUI) as a reason achieving CMMC Level 2 provides value.

3.1% of organizations decreased spending on CMMC certification.