CMMC certification efforts are continuing at most defense contractors surveyed by Redspin, despite a temporary pause in Phase 2. The company reports 78.2% are progressing toward certification or already hold third-party Level 2 certification.
Meanwhile, 21.9% reported delaying certification or significantly slowing implementation and certification efforts. The findings come from Redspin’s third annual study of the Defense Industrial Base, conducted in summer 2026.
CMMC Certification Retains Value Beyond Contract Eligibility
The Cybersecurity Maturity Model Certification study gathered feedback from contracting organizations handling Controlled Unclassified Information and Federal Contract Information. Redspin describes those activities as storing, processing or transmitting the information.
According to Redspin’s report announcement, the Department temporarily paused Phase 2, which was scheduled to start on November 10, 2026. The pause allowed some contractors to slow their certification work.
However, 75% of respondents said Level 2 certification provides value beyond contract eligibility. Among the benefits cited were independent cybersecurity validation at 68.8%, protecting Controlled Unclassified Information at 62.5%, and improved cybersecurity posture at 58.3%.
Dr. Thomas Graham, Redspin’s vice president and lead CCA, said many organizations continued moving forward. Graham emphasized that existing DFARS and NIST obligations remained, alongside responsibility for protecting sensitive information.
“What is particularly encouraging is that organizations continue to recognize the value of independent, third-party validation,” Graham said.
“Even with the third-party certification requirement paused, 75% of respondents still see value in achieving Level 2, and independent cybersecurity validation is one of the top reasons why,” Graham said.
The report distinguishes CMMC certification from underlying security obligations. It says requirements under Defense Federal Acquisition Regulation Supplement 252.204-7012, enforced in 2017, have not disappeared.
Security Spending Mostly Continues
Across multiple technologies and lines of effort, 75.4% to 84.4% reported no change in cybersecurity spending. Redspin found increases more common than decreases in security-related categories, particularly implementation efforts.
Those categories include managed services, cloud infrastructure and services, governance, risk and compliance tools, and NIST/DFARS consulting. Certification spending showed more pullback: 20.3% paused it, while another 3.1% reduced it.
Redspin also identified a connection between paused operational investments and slower certification work. All respondents pausing certain consulting, security operations or cloud spending reported pausing or slowing their CMMC efforts.
The specified spending covered NIST 800-171 consulting, security operations center/security information and event management/managed service provider services, or cloud platforms. Redspin says these investments support cybersecurity implementation and operations regardless of Phase 2’s timeline.
Block Editorial’s related reporting examines water-system cybersecurity challenges and threats involving exposed government data. Those stories concern separate incidents and organizations.
Prime Contractors Still Influence Subcontractor Deadlines
Only 23.3% of prime contractors were relaxing subcontractor requirements to meet Phase 2 requirements. Another 39.5% were still deciding, according to the company.
Among subcontractors, 76.6% had received no communication from their prime contractor about the pause. Only 10.6% said their prime contractor had paused CMMC requirements.
Graham said prime contractors would play a major role in determining when subcontractors need certification. A customer’s third-party assessment deadline may matter more to a business than the phased program timeline, Graham said.
Redspin titled the study “Committed to the Mission: The State of the DIB with CMMC in Flux.” It tracks defense industry progress toward cybersecurity and certification readiness in its third year.
The research covered several weeks before and after the pause announcement. Redspin then adjusted the survey to examine cybersecurity approaches, existing security obligations and certification efforts.
Related coverage of technology investment outcomes considers organizational implementation in a different survey. Redspin’s findings focus specifically on defense contractors and their security commitments.
For subcontractors continuing CMMC certification, Graham’s advice is to watch requirements from prime contractors alongside the official phased timeline. The pause does not necessarily remove a customer’s assessment deadline.
