The CMMC 2.0 Suspension:
What Your Peers Did Next
Immediately after the July 13 suspension announcement, Kiteworks asked 273 defense contractors what they did next. The first study of its kind. No comparable data existed.
In the past 12 months, 52% withdrew from a bid rather than pursue CMMC Level 2 certification, and 38% lost or were disqualified from a contract over the same requirement.
Frank Balonis, Field CISO at Kiteworks, and Michael Brooks, CMMC Strategy & Engagement Director at A‑LIGN, discussed what to fix and in what order before Phase II restarts.
Want the full report? It includes all 16 indicators, segment breakdowns, and a self‑scoring readiness checklist — schedule a demo and we'll walk you through it.
96% said their self‑attested SPRS score would hold up under review. 29% could produce both a current SPRS submission and an independently audited platform. Everything between those two numbers was confidence with nothing behind it.
Were concerned about False Claims Act exposure from an inaccurate self‑attestation with no assessor to catch it. 92% had already run some form of legal or compliance review since the suspension.
Of Tier 2‑and‑below subcontractors lost or were disqualified from a bid over CMMC Level 2 requirements — nearly double the 31% rate among prime contractors.
Kiteworks, State of CMMC 2.0 in the DIB · n=273 organizations confirmed to do business with the DoW, fielded July 17–31, 2026
Both sides of the assessment, in one room.
Frank Balonis
Field CISO, Kiteworks
Works with defense contractors on the controls that sit at the data layer — and on producing the audit trail a self‑attestation has to stand on when someone finally asks for it.
Michael Brooks
CMMC Strategy & Engagement Director, A‑LIGN
Leads CMMC strategy at a leading C3PAO. Brings the assessor's view of what happens when a confident SPRS score meets an independent review of the evidence behind it.
Moderated by Patrick Spencer, Ph.D., SVP, Americas Marketing & Industry Research at Kiteworks.
Actionable insights from data that exists nowhere else.
A readiness score you can run tonight
The CCMS / SGS / CSRI framework and all 16 binary indicators behind it — score your own organization against a survey mean of 60.0.
Where liability now concentrates
Why 48% of the DIB does not know Phase 1 obligations continue, and what a routine DIBCAC audit surfaced in the LOGZONE settlement.
What a defensible attestation requires
The evidence layer 47% of respondents named as what would most raise their own confidence — and the independent validation that sits on top of it.
Ready to close your own confidence gap?
See how Kiteworks gives you the audited evidence layer behind your SPRS score — before your next assessment, not after.
Schedule a demo