The Department of Defense is conducting a survey on the readiness of small businesses to meet the Cybersecurity Maturity Model Certification requirements, which are set to go into effect on Nov. 10, Federal News Network reported.
What Does the Pentagon Want to Know?
The DOD’s Office of Small Business Programs launched the Cybersecurity Compliance: Small Business Pulse Survey to identify concerns and challenges related to CMMC. According to the survey website, responses will enable the office to provide better guidance and resources to help small businesses meet the defense contracting requirements.
The survey includes questions about the organization’s current CMMC status, whether they have used a managed service provider or a consultant, their NIST SP 800-171 self-assessment and Supplier Performance Risk System score, and the estimated amount they expect to spend to achieve compliance.
The CMMC program aims to ensure that sensitive unclassified information, shared by the Pentagon with its contractors and subcontractors, is protected. As CMMC enters into force, defense agencies are expected to include cyber requirements in contracts.
The government shutdown is not expected to affect the CMMC’s implementation, according to Matthew Travis, chief executive officer of the Cyber Accreditation Body.
At Palo Alto Networks’ public sector conference, he shared that “CMMC is here,” even if no contracting officer is present to enforce it.
Is the DIB Ready for CMMC?
Despite the upcoming implementation of the CMMC, many companies within the defense industrial base remain unprepared for the acquisition rule.
In October, CyberSheath published its State of the DIB Report 2025, which found that only one percent of contractors are ready for assessments that would determine if they are eligible to continue doing business with the DOD.
The report also revealed that only 42 percent of respondents have submitted Supplier Performance Risk System scores with a median score of 60, which is below the required 110.
“Eighty thousand defense contractors need Level 2 certification, yet only 270 of these organizations currently hold final CMMC certificates,” CyberSheath CEO Emil Sayegh stated.
