Kiteworks says defense contractors are not ready for CMMC compliance

Kiteworks released a survey of 273 defense contractors showing a wide gap between confidence and proof of CMMC readiness after the Pentagon paused third-party assessments on July 13, 2026. The report says most contractors kept moving on compliance, but fewer than three in 10 can document the pieces needed to support their claims.

Why it matters: - The survey suggests many Defense Industrial Base contractors may be exposed to compliance, audit, and legal risk even after the suspension of CMMC 2.0 Phase II third-party assessments. - DFARS clause 252.204-7012 still applies, which means the obligation to attest accurately did not pause with the assessments. - Kiteworks says the gap between confidence and evidence could affect bidding, vendor selection, and False Claims Act exposure.

What happened: - Kiteworks released its 2026 “State of CMMC 2.0 Preparedness in the DIB” on Aug. 20, 2026. - The report is based on a survey of 273 defense contractors fielded in the days after the Department of War suspended CMMC 2.0 Phase II third-party assessments on July 13, 2026. - 98% of respondents said they took at least one action after the suspension, while 2% did nothing. - 96% said they are confident their self-attested Supplier Performance Risk System score would hold up under review. - Only 60% have a current SPRS submission, 36% run on a FedRAMP-authorized platform, and 29% have both. - Fewer than three in 10 organizations that consider themselves audit-ready appear to have the core evidence to support that claim.

The details: - Kiteworks built two survey-based measures: a CMMC Compliance Maturity Score averaging 78.2 out of 100 and a Suspension Governance Score averaging 74.9. - When those scores are multiplied, the combined CMMC Suspension Readiness Index drops to 60.0, far below the roughly 77 that a simple average would suggest. - The largest single group in the survey, 31% of respondents, scored low on both compliance maturity and suspension governance. - 84% of contractors said they are concerned about False Claims Act exposure from an inaccurate self-attested score. - 92% have already engaged legal or compliance review. - Even so, 80% of the weakest-compliance organizations still said they are confident their score would hold up. - 48% of contractors do not know that Phase 1 self-assessment obligations continue during the pause. - Respondents who called themselves “very confident” in their understanding averaged 2.48 out of 4 on a factual test of what the suspension changed, the same score as those who said they were only “somewhat confident.” - 55% are now bidding on work they previously would have avoided because of CMMC Level 2 requirements. - 52% have withdrawn from a Department of War bid, and 38% said they lost or were disqualified from a contract over the requirement. - Tier 2 and lower subcontractors reported bid loss at 55%, compared with 31% for prime contractors. - 89% are already using or plan to adopt a FedRAMP-authorized platform within six months. - 93% said independent third-party authorization will be essential or important to future vendor selection. - 93% plan to comment on the Department of War’s Request for Information. - 58% expect Phase II to return in a modified form. - Frank Balonis, Kiteworks field CISO, said the key issue is the gap between confidence and evidence. - Patrick Spencer, Kiteworks SVP of Americas Marketing and Industry Research, said the suspension is not a pause in accountability and that contractors should use the window to build defensible, audit-ready evidence. - Kiteworks included links for the full report and an upcoming webinar, “The CMMC 2.0 Suspension: What Your Peers Did Next,” scheduled for Sept. 2, 2026, at 9 a.m. PDT.

Between the lines: - The report argues that the suspension exposed an existing readiness problem rather than creating a new one. - The difference between the 77-point simple average and the 60-point combined index underscores how quickly readiness can fall when compliance controls and governance behavior are both weak. - The fact that confidence stayed high even among weaker performers suggests many contractors may be relying on perception instead of documentation. - The market response points to a split: some contractors are expanding into bids they avoided before, while lower-tier suppliers appear more vulnerable to contract losses.

What's next: - Contractors are expected to keep shifting toward FedRAMP-authorized platforms and third-party validation. - More companies are likely to weigh in on the Department of War’s RFI as they prepare for the next version of CMMC Phase II. - Kiteworks says most respondents expect Phase II to return, but many anticipate a modified structure.

The bottom line: - The suspension may have paused third-party assessments, but it did not pause the need to prove compliance. For many defense contractors, the bigger problem is not readiness claims — it is evidence.