snippetSep 11, 2026
The DIB reality check
~80,000 contractors need CMMC Level 2. Almost none of them are ready. The numbers, sourced.
The scale of the gap is the whole market thesis, so the numbers deserve to be exact and sourced:
~99%
of contractors who need CMMC Level 2 are not yet certified (1,074 of ~80,000 as of Mar 2026)
~80,000
contractors must reach Level 2 to keep CUI work — of ~300,000+ affected by the rule
1%
of DIB contractors feel fully ready for assessment — down from 8% (2023) and 4% (2024)
60
median submitted SPRS score, of 110 required (88 is the 80% conditional floor)
<100
authorized C3PAOs exist — when assessments resume, the queue is finite and first-come
Read together: the requirement did not shrink, the deadline pressure did not vanish — it converted into False-Claims-Act exposure under self-attestation and a queue that reopens hard if Phase II returns. “Everyone is behind” is not comfort; it means the line only gets longer.
Sources.
← All insights~99% / 1,074 of ~80,000 (Mar 2026), <100 C3PAOs — Cyber AB CMMC Marketplace
~80,000 need L2 / ~300,000+ affected — Federal Register 2024-22905; DoD CIO
1% ready (8%→4%→1%); median SPRS 60 — CyberSheath, State of the DIB Report 2025