Defense Contractors Report Highest Cybersecurity Scores Amid Confidence Decline

According to a recent report by Merrill Research, commissioned by CyberSheath, defense contractors have achieved their highest self-reported cybersecurity scores within the Cybersecurity Maturity Model Certification (CMMC) framework in five years. While the average Supplier Performance Risk System (SPRS) score increased to +51, its highest historical mark, the confidence in these reported scores diminished sharply by 24 percentage points. This decline reflects serious concerns regarding the reliability of self-attestations in cybersecurity compliance, particularly within the Department of Defense (DoD) procurement processes.

The CMMC framework is a regulatory measure introduced by the Pentagon to enforce mandatory cybersecurity practices across defense contracts. With new stipulations enacted, contractors are required to demonstrate compliance with cybersecurity standards. A critical aspect of this report indicates that 65% of contractors feel confident that their self-reported scores are correct, a steep decline from 89% in the previous year. Such statistics provoke apprehension, suggesting a looming crisis of confidence among contractors and procurement officials alike.

A noteworthy point raised by Dr. David M. Schneer, CEO of Merrill Research, indicates a stark contrast between reported improvements in cybersecurity capabilities and the trustworthiness of those claims. "The most striking finding this year is the widening gap between reported progress and confidence in that progress... That tension suggests that measuring progress requires looking beyond the reported score itself". This sentiment implies that stakeholders in the defense supply chain must start prioritizing verifiable assurance over self-reported metrics.

The implications for procurement officials are profound. As confidence in cybersecurity reporting wanes, there may be increased pressure for adaptations in CMMC compliance verification protocols, affecting contract eligibility and risk evaluations. Defense contractors, primarily composed of technical manufacturers and engineering specialists, risk losing government contracts if compliance measures are not sufficiently robust. Therefore, it is imperative for contractors to enhance their cybersecurity protocols genuinely and verifiably and prepare for evolving CMMC standards that may require both easier compliance pathways as well as rigorous accountability measures.

Moreover, participation in industry forums, such as the CMMC CON 2026 conference, is critical for procurement professionals and contractors. This event will offer insights into emerging cybersecurity requirements and best practices for maintaining compliance, ultimately aiding procurement decision-making.

The current backdrop of the defense sector reveals that while the resurgence in reporting scores may appear positive on the surface, the underlying issues of confidence and accuracy pose significant risks moving forward. Many contractors express that effective cybersecurity ought to remain manageable while achieving thorough, objective verification mechanisms. As compliance budgets have surged to an average of $155,204 annually, concerns have shifted from expenditure to efficacy, scrutinizing how well these investments convert into tangible security capabilities and operational safeguards.

In sum, these findings serve as a crucial wake-up call for the defense industrial base (DIB). While advancements in self-reported scores create an optimistic appearance, procurement and regulatory bodies must delve deeper into ensuring cybersecurity practices align with reported compliance through verifiable means. As the CMMC program evolves, maintaining a steadfast focus on accountability will be fundamental in fostering durable and resilient security across the defense supply chain.

• The average SPRS score reached +51, a historical five-year high
• Confidence in reported scores decreased from 89% last year to 65% this year
• 52% fear losing contracts due to non-compliance with cybersecurity standards
• 90% desire federal mandates for minimum cybersecurity standards across all contractors
• 24% believe their cybersecurity budgets are more than sufficient
• 53% are satisfied with their DFARS compliance budgets
• Major adopted technologies include multi-factor authentication (63%) and secure backup (48%)
• The CMMC CON 2026 will offer vital insights on cybersecurity compliance reforms
• Contractors should prepare for tougher compliance assessments as CMMC evolves
• The report emphasizes the gap between spending and effectiveness in cybersecurity measures