Kiteworks has released its 2026 “State of CMMC 2.0 Preparedness in the DIB” report, finding a gap between defense contractors’ confidence in their CMMC compliance and the evidence supporting that confidence.

The report is based on a survey of 273 defense contractors conducted in the days after the Department of War suspended CMMC 2.0 Phase II third-party assessments on July 13, 2026. According to Kiteworks, 98% of organizations took at least one concrete action following the suspension while 2% took no action.

However, the report found that confidence in compliance readiness does not consistently align with underlying evidence. While 96% of contractors said they were confident their self-attested Supplier Performance Risk System (SPRS) score would withstand review, only 60% reported having a current SPRS submission. Just 36% said they operate on a FedRAMP-authorized platform and 29% reported having both a current SPRS submission and a FedRAMP-authorized platform.

Measuring CMMC Readiness

The report introduces two indices based on the survey findings: the CMMC Compliance Maturity Score (CCMS) and the Suspension Governance Score (SGS).

The CCMS averaged 78.2 out of 100 while the SGS averaged 74.9. Kiteworks multiplied the two scores rather than averaging them to create the CMMC Suspension Readiness Index (CSRI), which averaged 60.0. The company said this approach reflects the need for both a strong compliance foundation and an active response to the suspension.

The largest group, representing 31% of the qualified population, scored low on both dimensions.

“The headline is that the DIB did not wait, and that is real,” said Frank Balonis, Field CISO, Kiteworks. “The finding that matters is the distance between confidence and evidence. When you multiply the two halves of readiness instead of averaging them, the score drops from 77 to 60, and nearly a third of an already-qualified base lands in the exposed corner. That is arithmetic, not opinion, and it is exactly the part a self-assessment score would never show you.”

Compliance and Legal Concerns

According to the report, DFARS clause 252.204-7012 remains in effect. Kiteworks said the suspension removed the third-party check on self-attestation but did not remove the obligation to attest accurately.

The survey found that 84% of contractors are concerned about False Claims Act exposure from an inaccurate self-attested score while 92% have already engaged legal or compliance review. Despite those concerns, 80% of organizations with the weakest compliance scores remained confident their scores would withstand review.

The report also found a knowledge gap surrounding the suspension. Forty-eight percent of contractors said they did not know that Phase 1 self-assessment obligations continue during the pause. Contractors who described themselves as “very confident” in their understanding of what the suspension changed averaged 2.48 out of 4 on a factual test, the same average recorded by those who described themselves as “somewhat confident.”

Impact on Bidding

The suspension is also affecting how contractors approach business opportunities involving CMMC Level 2 requirements.

Kiteworks found that 55% of contractors are now bidding on work they previously would have avoided because of CMMC Level 2 requirements. At the same time, 52% have withdrawn from a Department of War bid and 38% reported losing or being disqualified from a contract over the requirement.

The impact was greater among Tier 2 and lower subcontractors, which reported a bid loss rate of 55% compared with 31% among prime contractors.

“Contractors did the work. What most cannot do yet is prove it on demand,” said Patrick Spencer, SVP of Americas Marketing and Industry Research at Kiteworks. “A pause in assessments is not a pause in accountability. Government audits are still running, the False Claims Act still applies, and the record the government relies on is the score already on file. The organizations that come through this window in the strongest position are the ones treating it as time to generate defensible, audit-ready evidence – not as permission to coast.”

Demand for Authorized Platforms

The report found that contractors are responding to the compliance requirements by placing greater emphasis on authorized platforms and independent validation.

According to the survey, 89% of contractors are already using or plan to adopt a FedRAMP-authorized platform within six months. Meanwhile, 93% said independent third-party authorization will be essential or important in future vendor selection.

The survey also found that 93% of contractors plan to comment on the Department of War’s Request for Information and 58% expect CMMC Phase II to return in a modified form.

Register for the upcoming webinar, “The CMMC 2.0 Suspension: What Your Peers Did Next,” a moderated discussion with CMMC experts on September 2, 2026, at 9 AM PDT.