SPRS Scores Are Rising. Confidence Is Falling. What Defense Contractors Must Prove Before CMMC Returns

By Josh Hammer | August 25, 2026

A higher SPRS score should be good news.

But what if the number rises while fewer contractors believe the number is accurate?

That is the uncomfortable signal emerging from the latest defense industrial base data. According to a 2026 study of 302 defense contractors reported by MeriTalk, the average self-assessed Supplier Performance Risk System (SPRS) score climbed to +51, up from +33 in 2025. Yet the percentage of contractors who said they were extremely or very confident in the accuracy of their score fell from 89% to 65%.

The contradiction is not a statistical curiosity. It is the central compliance problem facing the Defense Industrial Base.

A score is not proof by itself. A score is a claim about the state of an environment at a particular point in time. The real question is whether the contractor can support that claim with accurate scope, current evidence, accountable owners, and records that show the controls were operating when the score was submitted.

That question matters even more after the Department of Defense paused the rollout of CMMC Phase 2 third-party assessment requirements on July 13, 2026. The pause may change the timing of external verification. It does not eliminate the underlying cybersecurity obligations, the duty to submit accurate assessments, or the consequences of making unsupported representations to the government.

For defense contractors, the lesson is straightforward:

Do not optimize for a higher SPRS number. Build a score you can defend.

The DIB’s SPRS score is rising - but the evidence gap is widening

The latest data presents two different stories.

The first story is encouraging. Average SPRS scores have improved significantly:

• 2024: -12
• 2025: +33
• 2026: +51

SPRS scores can range from -203 to +110, reflecting the implementation status of the security requirements derived from NIST SP 800-171. A score of +51 suggests that contractors, on average, are reporting more implemented practices than in prior years.

The second story is more troubling. Confidence in score accuracy has declined:

• 2024: 94%
• 2025: 89%
• 2026: 65%

Only 67% of survey respondents said they had submitted an SPRS score, which is another important limitation. Still, the trend is clear enough to demand attention: contractors are reporting better compliance outcomes while becoming less certain that those outcomes accurately describe operational reality.

A separate survey discussed by SecurityWeek reinforces the point. While 96% of respondents said they were confident their self-attested SPRS score would withstand review, only 29% could support that confidence with both a current SPRS submission and a FedRAMP-authorized platform.

Why can this happen?

Because compliance maturity and evidence maturity are not the same thing.

A company can implement more technical safeguards and still have weak documentation. It can deploy multifactor authentication, endpoint detection, backups, and vulnerability management while failing to document which systems are in scope, who owns each control, when the evidence was collected, or whether a subcontractor’s environment introduces an exception.

Think of the SPRS score as the result on a report card. The evidence is the work behind the grade. If the teacher asks for the assignments, attendance record, and grading rubric, the number alone is not enough.

A self-assessment is not a safe harbor

SPRS exists to capture a contractor’s assessment of its implementation of NIST SP 800-171 requirements. It is not a general cybersecurity maturity badge, and it is not a permanent certification.

The score depends on several underlying judgments:

1. Which systems process, store, or transmit covered information?
2. Which systems provide security protections for those systems?
3. Which controls are fully implemented?
4. Which controls are partially implemented or not implemented?
5. What evidence supports each conclusion?
6. When was the assessment performed?
7. Who reviewed and approved the result?
8. What changed after the score was submitted?

If those questions cannot be answered, the score may be mathematically correct according to the assessment worksheet and still be operationally indefensible.

This is why the July 13 suspension of CMMC Phase 2 should not be interpreted as permission to defer the hard work. The DoD CMMC FAQ and related departmental guidance make the distinction important: the third-party Phase 2 rollout is paused, but the cybersecurity responsibilities associated with applicable contracts remain.

Contractors must continue to:

• Protect controlled unclassified information (CUI).
• Meet applicable DFARS requirements.
• Implement the currently applicable NIST SP 800-171 Rev. 2 requirements.
• Maintain accurate self-assessments.
• Submit defensible SPRS scores.
• Preserve evidence that supports their representations.

The assessment mechanism may be under review. The obligation to protect sensitive information is not.

What the July CMMC pause does - and does not - change

The Department of Defense announced a 60-day reform review of CMMC on July 13, 2026. The stated objective is to examine the program’s cost, administrative burden, scalability, and implementation approach.

During the pause, the Phase 2 requirement for third-party assessments is suspended. That means the scheduled expansion of C3PAO assessments is not proceeding on its original timetable. It does not mean CMMC has been eliminated. It does not mean contractors can disregard DFARS. It does not convert an inaccurate self-assessment into an acceptable one.

This distinction is essential for executives and contracting teams.

A third-party assessment is a verification event. It is not the source of the underlying requirement. If your contract requires protection of CUI and implementation of specified security controls, those duties exist whether an independent assessor arrives this quarter, next year, or under a modified program.

There is also a practical business reason to keep preparing. The reform review may produce a less burdensome model, but no serious reform will make objective evidence irrelevant. In fact, the current data suggests the opposite. Contractors want implementation to be easier, but industry surveys also show strong support for independent verification and concern about False Claims Act exposure.

The likely future is not “no verification.” It is more efficient, more evidence-driven verification.

The LOGZONE lesson: unsupported cybersecurity claims can become financial claims

The Department of Justice’s June 2026 resolution with LOGZONE illustrates why contractors should treat SPRS submissions as serious legal representations.

According to the DOJ announcement, LOGZONE agreed to pay $507,144 to resolve allegations that it knowingly failed to comply with cybersecurity requirements in two Navy contracts.

The DOJ stated that LOGZONE submitted an SPRS score of 110 in 2021. A later Defense Contract Management Agency assessment resulted in a score of -170. The government alleged that LOGZONE had not implemented certain NIST SP 800-171 controls during the relevant period and had submitted claims for payment under contracts containing applicable cybersecurity requirements.

The allegations were resolved through a settlement. As DOJ expressly noted, there was no determination of liability.

That qualification matters. So does the broader lesson.

The risk is not simply that an assessor may lower your score. The risk is that a cybersecurity representation may be treated as material to the government’s decision to pay a claim. If the representation cannot be supported by contemporaneous evidence, the issue can move beyond an assessment disagreement and into False Claims Act territory.

The best protection is not a carefully worded disclaimer after the fact. It is disciplined governance before the score is submitted:

• Define the environment.
• Document the assessment methodology.
• Preserve evidence.
• Record decisions and exceptions.
• Assign accountable owners.
• Review the submission at the executive level.
• Monitor for changes after submission.

A score should be the end product of a controlled process - not an estimate assembled under bid pressure.

What a defensible SPRS score actually requires

A defensible score is more than a number in SPRS. It is a connected chain of facts.

1. A defined system boundary

You must know which systems are included and why.

That means documenting the architecture, endpoints, networks, cloud services, administrative tools, security components, and external connections that process, store, transmit, or protect CUI.

An undefined boundary produces two common errors: excluding systems that should be assessed or including systems without understanding their control responsibilities.

2. Accurate CUI scoping

CUI scoping is not a paperwork exercise. It determines where protections apply.

Your team should identify the types of CUI handled, where the data enters the environment, where it is stored, who can access it, how it moves, and which systems provide security functions for it. Subcontractor and cloud-provider relationships must be considered as part of that analysis.

A narrow scope may produce a better-looking score. It may also produce a score that does not reflect the actual environment supporting the contract.

3. Control-by-control implementation status

Every requirement needs a clear status and rationale.

“Implemented” should mean more than “we have a policy” or “the tool is installed.” The organization should be able to explain how the requirement operates, who is responsible, what systems are covered, and what evidence demonstrates performance.

For partial implementation, the remaining gap should be explicit. For non-implementation, the organization should document the risk, remediation path, and impact on the score.

4. Objective evidence

Evidence should demonstrate that a control exists and is functioning.

Examples include configuration exports, access reviews, vulnerability reports, training records, incident tickets, change records, system inventories, log samples, screenshots, and approval records. Evidence should be attributable to a system, date, owner, and control.

A policy written three years ago does not prove that an access review occurred last month.

5. Assessment dates and accountable owners

Every conclusion should have a date and an owner.

Who performed the review? Who supplied the evidence? Who approved the control status? What was the effective period of the evidence? What changed afterward?

Without these details, organizations struggle to reconstruct how a score was produced. That is precisely the problem that becomes expensive when a customer, contracting officer, assessor, or investigator asks for support.

6. POA&M discipline

A Plan of Action and Milestones should not become a parking lot for unresolved problems.

Each item should identify the affected control, root cause, responsible owner, milestones, target date, dependencies, compensating measures, and risk acceptance authority. The organization should also distinguish between a legitimate remediation plan and a control that is simply not implemented.

A POA&M can document a gap. It cannot make an implemented control out of an unimplemented one.

7. Subcontractor and flow-down visibility

Your score depends on more than your corporate headquarters.

Prime contractors must understand how subcontractors, managed service providers, cloud environments, system integrators, and remote support teams interact with CUI and in-scope systems. Contractual flow-down language is necessary, but it is not sufficient. You also need evidence that suppliers understand and meet the obligations assigned to them.

This is particularly important for construction firms and facility operators whose environments may include multiple vendors with remote access to building automation, engineering, and operational technology systems.

8. Ongoing monitoring

The environment changes after the score is submitted.

New assets appear. Firewall rules change. A vendor receives remote access. Firmware becomes outdated. A cloud service changes its configuration. An administrator leaves. A vulnerability becomes exploitable.

A score that was accurate in January may be inaccurate in August if the organization has no process for detecting and evaluating change.

Rev. 3 is important - but it does not erase Rev. 2

NIST published SP 800-171 Rev. 3 in May 2024. Rev. 3 introduces meaningful changes, including revised requirements, organization-defined parameters, and a stronger emphasis on assessment and monitoring.

Contractors should prepare for Rev. 3. They should map Rev. 3 requirements in parallel, identify overlaps, and understand where the organization will need new policies, procedures, technical capabilities, or evidence.

But preparation for a future transition cannot be used to ignore current obligations.

For contractors operating under current CMMC and DFARS requirements, NIST SP 800-171 Rev. 2 remains the practical baseline to manage unless and until the applicable contract or regulation changes. The responsible approach is to maintain the current Rev. 2 posture while building a crosswalk to Rev. 3.

This is where a “map once, satisfy many” strategy becomes valuable. The same evidence may support overlapping requirements across CMMC, NIST, RMF, SOC 2, and other frameworks - but only if the evidence is properly categorized, current, and tied to the correct system boundary.

The Siemens PLC advisory shows why point-in-time compliance fails

The need for continuous monitoring is not theoretical.

On August 19, 2026, CISA, NSA, FBI, DOE, and EPA issued Cybersecurity Advisory AA26-231A, warning of active AI-assisted attacks against Siemens S7 Series programmable logic controllers.

The advisory describes threat actors using internet scanning services and AI-generated scripts to identify and target exposed or poorly protected PLCs. The activity includes the use of open-source industrial automation libraries such as snap7.dll and python-snap7, potentially enabling read and write access to PLC memory, configuration data, and ladder logic through the S7comm protocol.

The agencies recommend immediate inventory, patching, network isolation, stronger access controls, logging, monitoring, and anomaly hunting.

This directly concerns organizations responsible for facility-related control systems (FRCS), building automation, industrial environments, and operational technology. A firewall rule that was correct when an assessment was performed does not protect an asset that was later connected to an internet-facing segment. A vendor account that was approved for maintenance may become a persistent access path. A controller that was patched may fall out of baseline after a replacement or engineering change.

For FRCS and OT environments, compliance evidence must connect to operational reality. You need to know what exists, where it is, who can reach it, what changed, and whether activity is consistent with approved maintenance.

That is why point-in-time compliance is insufficient. It can document yesterday’s posture while missing today’s exposure.

FedRAMP CR26 points toward the same future

FedRAMP is moving in the same direction.

The FedRAMP Consolidated Rules for 2026 emphasize clearer, reusable, measurable, and machine-readable evidence. FedRAMP also published Notice NTC-0014 aligning Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements with CISA BOD 26-04.

For affected cloud offerings, VDR and VER adoption becomes mandatory on December 7, 2026. The Consolidated Rules for 2026 become mandatory for current Rev. 5 certifications and other stakeholders on January 1, 2027.

The broader message is more important than the dates: legacy compliance binders and periodic scanning are being replaced by structured, risk-informed, continuously updated evidence.

Defense contractors should expect the same direction from CMMC reform. A future program may reduce administrative friction, but it will not make stale evidence more persuasive.

From scorekeeping to defensible compliance

The defense industrial base does not need more confidence unsupported by evidence. It needs a better operating model.

At H&V Complynt Cybersecurity Solutions, we built Complynt around that model. Complynt helps organizations map controls across frameworks, collect evidence, assign ownership, monitor changes, and maintain audit-ready documentation through a continuous compliance dashboard.

For federal contractors, our CMMC Level 2 compliance services support scoping, gap analysis, remediation planning, and readiness. For facility and OT environments, our RMF Division 25 and FRCS hardening services address the operational realities that conventional compliance programs often miss.

Complynt does not perform or guarantee a CMMC certification. Where an independent assessment is required, an authorized independent assessor performs that assessment. Our role is to help you arrive with a defined boundary, defensible evidence, current control status, and fewer surprises.

The question every contractor should answer now

If a contracting officer, assessor, customer, or investigator asked you to support your current SPRS score tomorrow, could you provide:

• The exact system boundary?
• The CUI data flow?
• The control-by-control status?
• The evidence behind every conclusion?
• The dates and owners for that evidence?
• The current POA&M?
• The status of subcontractor and cloud dependencies?
• The changes that occurred after the score was submitted?

If the answer is uncertain, the next step is not to wait for CMMC to return.

The next step is to make the score defensible now.

A rising SPRS average may indicate progress. Falling confidence tells us that progress is not yet dependable. The contractors best positioned for the next phase of CMMC will not be the ones with the most impressive number. They will be the ones that can prove exactly what the number means - and demonstrate that it remains true today.

Start with a free compliance readiness check or contact H&V Complynt Cybersecurity Solutions to build a clearer path from self-assessment to continuously supported, audit-ready compliance.

---