CyberSheath has released the State of the DIB Report 2025, revealing that only one percent of defense contractors are prepared for the Cybersecurity Maturity Model Certification final rule, which will take effect this November.
Defense Industrial Base Unprepared for Assessments
CyberSheath said Tuesday it commissioned Merrill Research to conduct the study, which reveals a significant lack of readiness among the defense industrial base as contractors prepare for assessments determining their eligibility to continue working with the Department of Defense. Preparedness dropped from eight percent in 2023 to four percent in 2024.
Compliance Gaps Persist Across DFARS & SPRS Metrics
While 69 percent of respondents claim Defense Federal Acquisition Regulation Supplement compliance via self-assessment, just 30 percent have undergone validated assessments. Only 42 percent have submitted Supplier Performance Risk System scores, with a median score of 60—far below the required 110. Notably, 17 percent reported negative scores.
Adoption of key cybersecurity measures remains limited. Only 27 percent of contractors implement multi-factor authentication, 25 percent use endpoint detection and response, and 21 percent deploy vulnerability management tools. Meanwhile, 89 percent report losses due to cyber incidents.
Remarks From CyberSheath CEO
“Eighty thousand defense contractors need Level 2 certification, yet only 270 of these organizations currently hold final CMMC certificates,” said CyberSheath CEO Emil Sayegh.
