Regulatory updates

October 6, 2025|CMMC

A CyberSheath / Merrill Research study finds just 1% of U.S. defense contractors are ready to comply with the upcoming CMMC final rule Executive Gov
Readiness among contractors has declined sharply over recent years: from 8 % in 2023 → 4 % in 2024 → now 1 % Executive Gov
Many contractors claim compliance via DFARS self-assessment, but only 30 % have been validated, and only 42 % have submitted SPRS scores (with a median of 60, far below the required 110) Executive Gov
Key cybersecurity controls are underutilized:

• 27 % use multi-factor authentication
• 25 % use endpoint detection & response
• 21 % use vulnerability management tools Executive Gov

Despite these gaps, 89 % of respondents report they’ve suffered losses from cyber incidents Executive Gov
To meet demand, ~80,000 defense contractors will ultimately require CMMC Level 2, but as of now only ~270 have final CMMC certification Executive Gov CMMC