# Regulatory updates

### CMMC DIB Readiness Updates

October 6, 2025|CMMC

- A CyberSheath / Merrill Research study finds just **1%** of U.S. defense contractors are ready to comply with the upcoming **CMMC final rule** [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)

- Readiness among contractors has declined sharply over recent years: from 8 % in 2023 → 4 % in 2024 → now 1 % [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)

- Many contractors claim compliance via **DFARS self-assessment**, but only **30 %** have been **validated**, and only **42 %** have submitted **SPRS scores** (with a median of 60, far below the required 110) [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)

- Key cybersecurity controls are underutilized:

• 27 % use multi-factor authentication  
  • 25 % use endpoint detection & response  
  • 21 % use vulnerability management tools [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)

- Despite these gaps, **89 %** of respondents report they’ve suffered losses from cyber incidents [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)

- To meet demand, **~80,000** defense contractors will ultimately require **CMMC Level 2**, but as of now only **~270** have final CMMC certification [Executive Gov](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report) CMMC

[https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report](https://www.executivegov.com/articles/dib-cmmc-final-rule-prep-cybersheath-report)