96% vs. 29%: The CMMC Compliance Gap Exposing Defense Contractors to False Claims Act Liability

The most important detail in these surveys is not the confidence gap. It is who has legal exposure because of it.

Kiteworks surveyed 273 defense contractors in the days following the Pentagon's July 2026 suspension of CMMC Phase 2 third-party assessments. Ninety-six percent said they were confident their Supplier Performance Risk System (SPRS) score would hold up under review. But Kiteworks also asked whether contractors could back that claim with documented evidence. Only 29% had both a current SPRS submission and a FedRAMP-authorized platform for handling Controlled Unclassified Information. The other 71% were confident without the evidence to support that confidence.

CyberSheath's fifth annual State of the Defense Industrial Base report, drawn from 302 contractors surveyed in May 2026, found a parallel picture that had been building for years. Average SPRS scores reached a five-year high of +51 (out of a possible 110). Confidence that those scores were accurate dropped sharply: 65% called themselves extremely or very confident, down from 89% in 2025 and 94% in 2024. Only 1% considered themselves completely prepared for formal CMMC certification.

The Suspension That Did Not Stop the Clock

The Pentagon's July 2026 suspension of CMMC Phase 2 third-party assessments removed the near-term pressure of external audits. It did not change the underlying legal framework.

DFARS clause 252.204-7021 requires defense contractors to self-attest their cybersecurity posture through SPRS as a condition of contract eligibility. That clause was not suspended. The requirement to submit an accurate SPRS score before bidding on covered DoD contracts remains in effect.

Nearly half of respondents in the Kiteworks survey did not know this. They believed Phase 1 self-assessment obligations had also been paused. They had not. And their contracts contain attestations that predate the suspension and may not accurately reflect their current security posture.

The Kiteworks finding that stands out: 84% of contractors said they were concerned about False Claims Act liability tied to an inaccurate SPRS score. And 92% had already brought in legal or compliance review. These are not organizations that are unaware of the risk. They are organizations that are aware of the risk and uncertain whether their attestation would survive scrutiny.

What False Claims Act Liability Actually Means Here

The False Claims Act (31 U.S.C. § 3729) imposes civil liability of up to three times actual damages plus civil penalties on any person who knowingly submits a false claim to the federal government. In the CMMC context, a contractor that attests CMMC compliance in SPRS while not actually implementing the required practices is submitting a false claim for each contract payment received under that attestation.

The Department of Justice has been pursuing FCA cases against defense contractors for cybersecurity misrepresentations since at least 2022. The first major settlement under this enforcement theory was in 2021, when Aerojet Rocketdyne paid $9 million after a former employee filed a qui tam complaint alleging the company misrepresented its cybersecurity compliance on government contracts.

The suspension of CMMC Phase 2 assessments does not reduce this exposure. It may increase it. Without a third-party assessor validating contractor SPRS scores, the gap between claimed compliance and actual security posture is wider and less visible. The enforcement mechanism that remains active is the Department of Justice, acting on qui tam complaints from employees with direct knowledge of the gap.

The survey data makes clear that a significant portion of the defense industrial base is in a position where their SPRS attestation does not reflect their actual security posture. Fifty-five percent of contractors are now bidding on work they previously avoided due to CMMC Level 2 requirements, suggesting that the suspension is being read as lowering the bar. It has not.

Where the Actual Security Gaps Are

CyberSheath's survey provides visibility into which security controls are most commonly missing. The adoption rates among surveyed defense contractors reveal the specific gaps that drive the distance between SPRS scores and actual CMMC readiness:

Multi-factor authentication has the highest adoption at 63%. That means 37% of defense contractors handling CUI do not have MFA in place, despite it being one of the most basic NIST SP 800-171 requirements. Secure backup stands at 48%. Data-loss prevention and vulnerability management are both at 44%. Endpoint detection and response is at 40%.

These are not advanced security capabilities. They are foundational controls that CMMC Level 2 requires. An organization that does not have EDR deployed cannot truthfully attest to Practice AC.L2-3.1.1 through Practice IR.L2-3.6.2 without significant caveats. An organization without MFA cannot honestly claim compliance with IA.L2-3.5.3.

The average annual compliance budget of $155,000, which 53% of contractors describe as "just right," reflects a fundamental mismatch. Building a credible CMMC Level 2 program with an enclave approach, documented policies, and implemented technical controls typically costs substantially more for organizations of any meaningful size. The satisfaction with a $155,000 budget is consistent with a compliance program focused on documentation rather than actual implementation.

The Confidence Problem Is a Measurement Problem

The 96% vs. 29% gap is not primarily a security problem. It is a measurement problem. Contractors that cannot verify their own compliance posture with documented evidence are relying on confidence built from incomplete self-assessment. The Kiteworks data points to what that looks like in practice: contractors who call themselves "very confident" in their understanding of CMMC requirements score no better on a factual test of those requirements than contractors who call themselves only "somewhat confident."

Self-assessment without objective evidence tends to drift toward optimism over time. Annual reviews built around questionnaires rather than control validation allow gaps to accumulate between assessment cycles without triggering a score adjustment. CMMC was designed to break this pattern through mandatory third-party certification. The suspension of Phase 2 has temporarily restored the conditions that CMMC was supposed to eliminate.

What CISOs and Compliance Teams Should Do Now

Run an honest internal gap assessment against NIST SP 800-171. Not against the SPRS score. Against the 110 practices. For each practice, ask whether you can produce objective evidence of implementation: configuration records, audit logs, policy documentation with last-review dates, and test results. If you cannot produce the evidence, the practice is not implemented for CMMC purposes regardless of what your SPRS score says.

Engage legal counsel before the next contract renewal. If your SPRS score includes practices that your gap assessment reveals are not fully implemented, you need legal advice on how to handle the attestation before submitting a new bid. The FCA exposure attaches to each contract payment, not just the initial bid. Getting ahead of this before renewal is significantly less costly than responding to a qui tam complaint.

Address the three most common gaps first. MFA at 63% adoption, EDR at 40%, and secure backup at 48% are the controls where the defense industrial base shows the most systematic weakness. These are also the controls that a DoJ investigator would check first and that a qui tam plaintiff would most likely have direct evidence about. Closing these three gaps closes the highest-probability legal exposure.

Build your SPRS score from evidence, not from memory. For each practice you claim in SPRS, maintain a file with the objective evidence that would satisfy a C3PAO assessor: configuration screenshots, policy documents, training records, audit logs. If Phase 2 assessments return in a modified form (58% of survey respondents expect this), that evidence base is what determines whether you pass. Building it after the assessor arrives is too late.

Educate your team on what the suspension did and did not change. Nearly half of contractors surveyed did not know Phase 1 obligations continued. If your procurement, legal, and technical teams have the same misunderstanding, decisions about contract bids, SPRS submissions, and security investments are being made on faulty assumptions. A brief internal briefing from counsel on the actual state of DFARS obligations is worth the time.