CMMC Phase 2 Assessments Are Paused. The False Claims Act Is Not.

Two industry surveys released this week found defense contractors more confident in their cybersecurity compliance than at any point measured, and less able to demonstrate it ^[1]. That is a problem specifically because the Pentagon's July suspension of CMMC 2.0 Phase 2 third-party assessments removed the check on attestations without removing the obligation to make them accurately ^[8].

Kiteworks surveyed 273 defense contractors in the days after the suspension ^[2]. Ninety-six percent said they were confident their self-attested Supplier Performance Risk System score would survive review; 29% could support that with both a current SPRS submission and a FedRAMP-authorized platform ^[3]. The 67-point spread between belief and evidence is the entire story ^[4]. Kiteworks scored its two readiness measures by multiplying rather than averaging them, producing a combined 60 out of 100 against roughly 77 for a simple average, a 17-point difference that reflects how many firms are weak on both dimensions at once ^[5][6]. Nearly a third of respondents were in that group, the largest single cluster in the report ^[7].

The legal exposure is understood, if unevenly. Eighty-four percent told Kiteworks they were concerned about False Claims Act liability tied to an inaccurate score, and 92% had already brought in legal or compliance review ^[9][10]. But nearly half did not know that Phase 1 self-assessment obligations continued through the pause, and contractors who called themselves "very confident" in their grasp of the changes scored no better on a factual test than those who said they were only somewhat confident ^[11][12]. Confidence, on this evidence, is not a proxy for knowledge.

The market repriced quickly. Fifty-five percent said they are now bidding on work they had previously avoided because of CMMC Level 2 requirements, while 52% had withdrawn from a Department of War bid and 38% had lost or been disqualified from a contract over the same requirement ^[13][14]. Tier 2 and lower subcontractors reported bid losses at 55%, against 31% for primes ^[15].

The longer-running data points the same direction. CyberSheath and Merrill Research surveyed 302 contractors in May 2026, before the suspension took effect ^[16]. Average SPRS scores hit a five-year high of +51, up from +33 in 2025 against a possible 110 ^[17]. Confidence that those scores were accurate fell to 65% extremely or very confident, from 89% a year earlier and 94% in 2024 ^[18]. One percent considered themselves completely prepared for CMMC certification, unchanged year over year ^[19]. Average annual DFARS compliance budgets reached $155,000, and 53% called that just right with another 24% calling it more than enough ^[20]. Adoption of basics remains partial: multi-factor authentication at 63%, secure backup at 48%, data-leakage protection and vulnerability management at 44%, endpoint detection at 40% ^[21].

"The finding that matters is the distance between confidence and evidence," said Frank Balonis, field CISO at Kiteworks ^[24]. CyberSheath CEO Emil Sayegh framed it as a workforce problem, noting that most contractors are manufacturers and engineers rather than security specialists, and argued reform should make compliance easier without giving up objective, verifiable proof ^[25].

Watch the comment record. Ninety-three percent of Kiteworks respondents plan to file on the Department of War's request for information, and 58% expect Phase 2 to return in modified form ^[22]. Ninety-three percent also said independent third-party authorization would be essential or important in future vendor selection, and 90% of CyberSheath respondents want minimum standards mandated across all federal contractors ^[23][26]. The industry is asking for the audit back. Until it returns, the score on file is the only artifact, and it is the one a relator reads.