DIB Organizations Maintain Cybersecurity Commitment Amid CMMC Phase 2 Pause

• •78.2% of DIB organizations are pursuing or have achieved CMMC Level 2 certification.
• •75% of respondents value Level 2 certification beyond contract eligibility.
• •75.4% to 84.4% report no change in cybersecurity spending amid the CMMC pause.

A recent Redspin report indicates that despite a temporary pause in the rollout of Cybersecurity Maturity Model Certification (CMMC) Phase 2, a majority of Defense Industrial Base (DIB) organizations are either continuing their certification efforts or have already achieved Level 2 certification. Specifically, 78.2% of surveyed organizations reported ongoing progress toward certification, while 21.9% indicated a slowdown or delay in their efforts. The report highlights that 75% of respondents still see value in achieving Level 2 certification beyond contract eligibility, with many citing independent cybersecurity validation and commitment to protecting Controlled Unclassified Information (CUI) as key reasons. Additionally, 75.4% to 84.4% of organizations reported no change in cybersecurity spending, with increased investment more common than reductions. The findings also reveal that prime contractors continue to influence certification timelines for subcontractors, with only 23.3% relaxing Phase 2 requirements. This suggests a resilient commitment to cybersecurity within the DIB, despite uncertainties surrounding CMMC.