53% of Defense Industrial Base members are currently using a cloud service provider to minimize their Cybersecurity Maturity Model Certification scope.

68% of Defense Industrial Base members reported that preparing for Cybersecurity Maturity Model Certification has taken them over a year as of November 2025.

14% of Defense Industrial Base members are considering using a cloud service provider for Cybersecurity Maturity Model Certification compliance in the future.

47% of Defense Industrial Base members have received flow-down requests from prime contractors regarding Cybersecurity Maturity Model Certification.

54% of Defense Industrial Base members reported starting their Cybersecurity Maturity Model Certification journey with a strong implementation of NIST 800-171 standards and DFARS controls.

31% of Defense Industrial Base members reported spending more than $250,000 on Cybersecurity Maturity Model Certification preparation as of November 2025.

60% of Defense Industrial Base members reported an increase in training staff on cybersecurity since last year, up from 37% .

26% of Defense Industrial Base members reported spending between $100,000 and $250,000 on Cybersecurity Maturity Model Certification preparation as of November 2025.

37% of Defense Industrial Base members are not scheduled for a Cybersecurity Maturity Model Certification assessment or are unsure of their next steps.

The estimated number of defense contractors that require Level 2 certification is 80,000.

42% of contractors have submitted SPRS scores (a fundamental requirement for demonstrating compliance).

78% of defense contractors lack patch management solutions.

The number of organizations that currently hold final CMMC certificates is 270.

The approximate annual budget contractors are investing in compliance, as budgets have grown, is nearly $50,000.

The median SPRS score has improved from 20 in 2022’s inaugural report to 60 this year, but 17% of contractors still report negative scores, far below the required 110 benchmark.

79% of defense contractors lack vulnerability management solutions.

74% of defense contractors lack data leakage protection.

Only 1% of defense contractors report being fully prepared for the upcoming CMMC assessments.

30% of contractors completed medium or high assessments that would validate their actual security posture.

73% of defense contractors lack multi-factor authentication (MFA).