Most defense industrial base (DIB) organizations are continuing toward Cybersecurity Maturity Model Certification (CMMC) or have already achieved Level 2 certification despite the Defense Department’s (DOD) temporary pause of Phase 2 implementation, according to the third annual DIB cyber report from Redspin.
CMMC is a DOD regulatory framework that verifies defense contractors and subcontractors have implemented required cybersecurity standards to protect sensitive government information.
Redspin’s report is based on a summer 2026 survey of contracting organizations that store, process, and/or transmit controlled unclassified information and federal contract information. The survey that 78.2% of respondents are continuing their progress toward CMMC certification or are already Level 2 certified by a third party. Another 21.9% said they have delayed certification or significantly slowed implementation and certification efforts.
On July 13, the DOD paused implementation of CMMC Phase 2 while it conducted a 60-day review of the program. On Sept. 3, DOD codified the pause of Phase 2, which had been scheduled to take effect Nov. 10. Phase 1 requirements remain in place.
“The data shows that yes, the pause gave an opportunity for some organizations to slow their CMMC efforts, but on the other hand many have actually continued moving forward,” said Thomas Graham, Redspin vice president and lead CMMC certified assessor. “What is particularly encouraging is that organizations continue to recognize the value of independent, third-party validation.”
The survey found that 75% of respondents continue to see value in achieving Level 2 certification beyond contract eligibility. Among those respondents, 68.8% cited independent cybersecurity validation, 62.5% cited a commitment to protecting controlled unclassified information, and 58.3% cited an improved cybersecurity posture.
“The fact that so many DIB organizations continue hardening their cybersecurity posture and making investments is a testament to the value CMMC brings,” Graham said. “Even with the third-party certification requirement paused, 75% of respondents still see value in achieving Level 2, and independent cybersecurity validation is one of the top reasons why.”
Despite that continued push toward certification, some organizations have pulled back on CMMC-specific spending. The survey found that 20.3% of respondents had paused certification spending, while another 3.1% had decreased it.
More broadly, however, cybersecurity spending has remained largely steady. Between 75.4% and 84.4% of respondents reported no change in spending across multiple technologies and lines of effort.
Prime contractors also continue to influence certification timelines for subcontractors. Just 10.6% of subcontractors said their primes had paused CMMC requirements, while 76.6% said they had not received communication from their prime contractor about the pause. Among prime contractors, only 23.3% said they are relaxing requirements for subcontractors to meet Phase 2 requirements, while 39.5% are still deciding.
“As was the case before the Phase 2 pause, primes are going to play a big role in determining when their subs need to be certified,” Graham said. “The phased CMMC timeline is important, but it’s not necessarily the only timeline contractors should be watching. If your prime tells you they need a third-party assessment by a certain date, that timeline may matter a lot more to your business.”