Kiteworks study says defense contractors are unready for CMMC despite confidence

Kiteworks says a new survey of 273 defense contractors found most believe they would pass a CMMC audit, but far fewer can document the evidence behind that confidence. The report lands as the Defense Industrial Base adjusts to the Department of War’s suspension of Phase II third-party assessments and faces ongoing legal and compliance risk.

Why it matters: - Defense contractors still face CMMC-related obligations even after the Department of War suspended Phase II third-party assessments on July 13, 2026. - Kiteworks says the gap between confidence and evidence could leave contractors exposed to audit, contract, and False Claims Act risk. - The findings matter most for the Defense Industrial Base, where readiness now affects bid access and vendor selection.

What happened: - Kiteworks released its 2026 “State of CMMC 2.0 Preparedness in the DIB,” based on a survey of 273 defense contractors fielded in the days after the July 13 suspension. - The report found that 98% of respondents took at least one concrete action after the suspension, while 2% did nothing. - 96% of contractors said they are confident their self-attested Supplier Performance Risk System score would hold up under review. - Only 60% have a current SPRS submission, 36% run on a FedRAMP-authorized platform, and 29% have both. - Fewer than three in 10 organizations that describe themselves as audit-ready have the key components needed to support that claim.

The details: - Kiteworks built two survey-based measures: a CMMC Compliance Maturity Score averaging 78.2 of 100 and a Suspension Governance Score averaging 74.9. - The company multiplied those scores to create a CMMC Suspension Readiness Index of 60.0, which it said is well below the roughly 77 that a simple average would imply. - The largest group, 31% of respondents, scored low on both readiness measures. - Frank Balonis, Kiteworks Field CISO, said the difference between confidence and evidence is the key issue and said multiplying the two readiness measures shows a drop from 77 to 60. - DFARS clause 252.204-7012 never paused, and the suspension removed the third-party check on self-attestation rather than the obligation to attest accurately. - 84% of contractors said they are concerned about False Claims Act exposure from an inaccurate self-attested score. - 92% have already engaged legal or compliance review. - 80% of the weakest-compliance organizations still said their score would hold up. - 48% of contractors do not know that Phase 1 self-assessment obligations continue during the pause. - Respondents who called themselves “very confident” in their understanding scored 2.48 out of 4 on a factual test, the same average as those who called themselves only “somewhat confident.” - 55% of contractors are now bidding on work they previously would have avoided because of CMMC Level 2 requirements. - 52% have withdrawn from a Department of War bid, and 38% report losing or being disqualified from a contract over the same requirement. - Tier 2 and lower subcontractors reported a bid-loss rate of 55%, compared with 31% among prime contractors.

Between the lines: - The suspension appears to have intensified scrutiny rather than reduced it. - Contractors are still investing in compliance, but the survey suggests many are measuring readiness by confidence instead of proof. - Patrick Spencer, Kiteworks SVP of Americas Marketing and Industry Research, said the pause is not a pause in accountability and that the strongest organizations will use the window to build defensible, audit-ready evidence. - Demand is moving toward platforms and reviews that can stand up to third-party scrutiny.

What's next: - 89% of contractors said they are already using or plan to adopt a FedRAMP-authorized platform within six months. - 93% said independent third-party authorization will be essential or important to future vendor selection. - 93% also plan to comment on the Department of War’s Request for Information. - 58% expect Phase II to return in a modified form. - Kiteworks is promoting the full report and a webinar, “The CMMC 2.0 Suspension: What Your Peers Did Next,” scheduled for Sept. 2, 2026, at 9 a.m. PDT.

The bottom line: - The survey suggests many defense contractors are more confident than compliant, and the suspension has not changed the need to prove readiness with evidence.