CMMC Statistics 2026: Certification Counts, Costs, Small Business Impact & Enforcement Data

Key CMMC statistics at a glance

What this shows — and what it doesn’t

The population and cost numbers describe original rulemaking assumptions. The certification figures describe the September 29, 2026 snapshot. DoD’s modeled cost is not a minimum market price, and it excludes implementation and remediation. Dividing a system-scope certificate count by a projected entity count provides a scale comparison, not a measured compliance rate. The historical $39.0 million defense-related enforcement snapshot remains labeled July 2; use the separate settlements tracker for its expanded dated dataset.

These figures do not show a compliance rate or total compliance cost. DoD’s modeled cost excludes implementation and remediation. Public aggregate counts also lack the ready-applicant queue, regional or industry fit, assessment scope, team availability, conflicts and calendar data needed to infer a booking backlog.

How we built this page

We read both CMMC rules in the Federal Register — the program rule (32 CFR Part 170) and the acquisition rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) — along with the current clause text on Acquisition.gov, DoD’s published reports and CIO guidance, the February 2026 class deviation memo, Department of Justice settlement announcements, Cyber AB Town Hall disclosures, and original reporting from Reuters and Federal News Network. We recomputed every number independently and checked it against its stated source.

Every statistic carries one of three evidence grades, or a calculation label:

Claims that fail all four categories — no source, no denominator, no methodology — do not appear as facts anywhere on this page. They appear in one place only: the “claims we could not verify” section near the end.

Two related references in this section update on their own schedules: our CMMC certification tracker (monthly, after each Cyber AB Town Hall) and our cybersecurity enforcement ledger (event-driven, as DOJ announces resolutions). Figures on this page are snapshots from those datasets as of the verification date above.

How to cite this page

The October 3, 2026 dataset, with source, evidence grade and retained row-level verification dates, is available as a CSV at /research/cmmc-statistics/cmmc-statistics-ledger-2026-10-03.csv and through the stable cmmc-statistics-ledger.csv URL — no email required.

How many companies need CMMC?

DoD estimates 337,968 unique entities — prime contractors and subcontractors combined — will be subject to CMMC requirements by Year 4 of the phased rollout, according to the DFARS final rule published September 10, 2025. Of those, 229,818 (68%) are small entities. The requirement applies to any contractor whose information systems process, store, or transmit federal contract information (FCI) or controlled unclassified information (CUI) under a DoD contract, with a carve-out for contracts solely for commercially available off-the-shelf (COTS) items.

How DoD counted.The department doesn’t actually track unique offerors, and it has no contractual relationship with subcontractors at all. So the rule’s analysis works from assumptions: roughly 28,164 annual solicitations, an assumed average of two offerors each (56,328 prime offerors), and an assumed five subcontractors per prime proposal. Multiply through and you reach 337,968 unique entities. That means the headline number is a model output, not a census — a distinction that matters when extrapolating.

The phase-in is deliberately back-loaded for small businesses. The rule projects 1,104 small entities affected in Year 1, 5,565 in Year 2, 18,554 in Year 3, and the full 229,818 by Year 4 and beyond.

One precision note writers routinely miss: CMMC certifies information systems, not companies. Each assessed system receives a CMMC unique identifier (UID) in SPRS, DoD’s contractor-performance database, and a single company can hold several. The Cyber AB reinforced this at its May 2026Town Hall in guidance on joint ventures, which must identify every UID used in contract performance. “Companies certified” and “certificates issued” are close approximations, not identical measures.

How many companies need CMMC Level 2 certification?

The DFARS final rule projects 118,289 entities will require Level 2 certification by a Certified Third-Party Assessment Organization (C3PAO) — an independent assessor authorized by the Cyber AB — by Year 4 of implementation. That is 35% of all impacted entities. A much smaller group, about 6,759 entities (2%), will be allowed to self-assess at Level 2 for lower-risk CUI. The two paths are frequently collapsed into one “Level 2” number; they shouldn’t be.

About that “80,000” figure you keep seeing.A claim that “roughly 80,000 contractors need Level 2 certification” circulates widely. We could not pin that exact figure to current rule text. What we canreproduce: apply the rule’s 35% Level 2 (C3PAO) share to the 229,818 small entities and you get 80,436 small entities in the certification population (TDCR calculation) — almost certainly the origin of the ~80,000 shorthand. The correct all-entity figure is 118,289.

How many companies are CMMC certified right now?

The Cyber AB’s September 29, 2026 primary deck reports 2,362 final Level 2 Certificates of CMMC Status, 71 conditional certificates and 151 assessments in progress. A certificate covers an assessed information-system scope; the deck does not provide a unique-company total. Source: September deck, p. 19.

The latest three snapshot changes average 232 final certificates per month: (200 + 239 + 257) ÷ 3. The full tracker preserves earlier monthly records, source definitions and restatements. These point-in-time counts do not measure booking availability or the number of assessment-ready organizations.

Conditional certificates account for about 2.9% of final-plus-conditional certificates in the September snapshot: 71 ÷ (2,362 + 71). This is a certificate-status share, not a share of unique companies.

What are the official CMMC cost statistics?

DoD’s official estimate for a small entity’s Level 2 certification is $101,752 initially and $104,670 over the full three-year cycle — and that figure covers only assessment, certification, and affirmation activity. It excludes implementation and remediation entirely. Both numbers come from the CMMC Program final rule’s regulatory analysis.

What DoD’s $104,670 estimate does not include

The rule states that implementation costs are not attributed to CMMC because the underlying requirements already exist: the basic safeguarding clause at FAR 52.204-21 has applied since June 15, 2016, and DFARS 252.204-7012 required full implementation of NIST SP 800-171 — the 110-requirement federal standard for protecting CUI — by December 31, 2017. In DoD’s accounting, a contractor handling CUI should have absorbed those costs years ago. CMMC merely charges you to prove it.

The proof that this was a choice, not an oversight: at Level 3, where the rule adds genuinely new requirements drawn from NIST SP 800-172, DoD did count engineering costs — an estimated $2.7 million in nonrecurring and $490,000 in recurring engineering costs for a small entity. The department costs implementation when requirements are new and excludes it when they’re preexisting. That accounting boundary is the single most useful thing to understand about every CMMC cost figure in circulation.

The gap between the certification paths is itself instructive: a small entity’s three-year Level 2 certification estimate runs $67,474 more than the self-assessment path($104,670 − $37,196; TDCR calculation). For scale, the rule’s own analysis puts the DFARS acquisition rule’s total cost at $344.9 million in present value over ten years at a 3% discount rate ($329.1 million public, $15.8 million government).

What contractors actually budget is a different question — and a different grade of evidence. In a PreVeil survey of more than 2,000 defense contractors (sponsor: PreVeil, a compliance platform vendor), 70% had budgeted less than the DoD estimate for Level 2 certification. The 2025 Merrill Research survey commissioned by CyberSheath, a CMMC managed services provider, found annual compliance budgets averaging nearly $50,000. We publish these as what they are — named surveys with disclosed sponsors (C) — not as official figures.

Is there enough C3PAO capacity — and is there a backlog?

The September 29, 2026 Cyber AB primary deck reports 117 Authorized or Accredited C3PAOs, 1,179 Certified CMMC Assessors and 681 Lead CCAs. These counts do not establish current booking availability or a national assessment backlog. Obtain scope-specific availability from the assessor you are considering. The comparisons below are historical model illustrations, not a measurement of spare capacity or a finding that contractor readiness is the sole national constraint. Source: September deck, p. 20.

The historical monthly ecosystem series retains its original snapshot dates and definitions. For the latest reported values, use the September 29, 2026 source snapshot and the dated rows in the full certification tracker.

Historical population projections and earlier ecosystem headcounts can be compared only with their assumptions and units kept explicit. These comparisons do not describe current appointment supply or establish a backlog.

Historical headcounts and hypothetical throughput calculations cannot resolve today’s scheduling question. Public aggregate counts lack the ready-applicant queue, regional or industry fit, assessment scope, team availability, conflicts and calendar data needed to infer a booking backlog. The current certificate and headcount snapshots are available in the full tracker; direct written assessor availability is the useful evidence for an actual purchase.

How does CMMC affect small businesses?

DoD’s original rulemaking projected that small entities would represent 68% of the CMMC population: 229,818 entities, including prime contractors and subcontractors. Applying the modeled 35% Level 2 (C3PAO) share to that small-entity count gives about 80,436 as a TDCR calculation. These are planning estimates, not a current supplier census or a measured effect of CMMC.

DoD’s February 2022 State of Competition report found that the small-business population in the defense industrial base had shrunk by more than 40% over the preceding decade. That historical trend predates CMMC and does not measure exits caused by certification requirements. The report’s supplier-loss projection is also historical. CMMC’s 2024 rulemaking cost model is an estimate of assessment and affirmation activity, not a six-figure minimum quote or a current requirement for every supplier; implementation cost and the written procurement requirement must be evaluated separately.

The early evidence on how suppliers are responding is journalistic, and we grade it accordingly (grade C: original reporting, attributed). Reuters reported on February 20, 2026 that the new rules are leading some small suppliers to rethink military work: three aerospace companies each told Reuters they have suppliers who will not undergo the CMMC audit; the president of one U.S. firm said half of its suppliers had not indicated whether they will comply; and one Canadian supplier executive put his combined EU/US compliance cost at about C$500,000 (roughly US$365,000). The Aerospace Industries Association told Reuters that accumulating regulatory costs are forcing some member firms to “reconsider — if not exit” the defense marketplace. Reuters also cited 2022 House Small Business Subcommittee data that 88% of aerospace firms are small businesses. These are documented examples and on-record statements — not an exit rate. No verified exit-rate statistic exists (see the unverified-claims section).

A June 2026 report described a Senate FY2027 NDAA proposal for a CMMC assessment grant program. That is a historical proposal, not an available grant or enacted funding entitlement. This update has not established its October 2026 legislative status. Do not budget for or apply for funding based on that proposal summary; check the current bill text and any enacted program or official application notice before relying on it. The historical NCODE award figures and separate proposed tax-credit discussion also retain their original source periods.

What CMMC enforcement actions have happened?

This historical July 2, 2026 selected-case table contains 13 cybersecurity-related FCA resolutions totaling $60,393,500, including 10 defense-related resolutions totaling $38,986,778. It is not the complete or current enforcement ledger. For the expanded dataset and its current totals, use the cybersecurity FCA settlements tracker.

Historical selected-table calculation: 13 resolutions, $60,393,500 total; defense-related subset, 10 resolutions, $38,986,778. These figures describe the rows above, not every publicly announced cyber FCA resolution.

September 1, 2026 update: DOJ announced that Honeywell Aerospace Inc. agreed to pay $2,042,518 to resolve allegations of NIST SP 800-171 noncompliance under a DoD contract. The alleged conduct ran from April 2020 through December 2023. The stated whistleblower share was $375,823. The settlement resolved allegations; DOJ reported no determination of liability.

Source: S10.

The case that explains why third-party verification exists. On June 18, 2026, DOJ announced that LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 over two Navy contracts spanning May 2021 to March 2025. The company had assessed itself a perfect 110 in SPRS. When the Defense Contract Management Agency assessed the same environment, it scored −170— near the bottom of the −203-to-110 scale. Half the settlement, $253,572, is restitution. A 280-point gap between self-report and government assessment, in one sentence, is the entire argument for CMMC.

Two more patterns worth a writer’s attention. The Raytheon/Nightwing resolution held Nightwing liable as successorfor conduct predating its acquisition of Raytheon’s cyber business — acquirers now inherit cyber-FCA exposure. And the Georgia Tech resolution paid whistleblowers $201,250 of the $875,000 recovery, a reminder of where these cases originate. Separately, the Administrative False Claims Act (December 2024) now lets agencies pursue smaller cyber misrepresentations directly, without a DOJ suit.

How ready is the defense industrial base?

The most complete public multi-year readiness series we found — Merrill Research’s annual survey commissioned by CyberSheath, a CMMC managed services provider — found only 1% of surveyed contractors felt fully prepared for CMMC assessments in 2025, down from 8% in 2023 and 4% in 2024. Over the same series, the median self-reported SPRS score rose from 20 in 2022 to 60 in 2025. This is self-reported survey data with a commercial sponsor, and we grade it accordingly. We publish it anyway because it is the only multi-year readiness series with a named research firm and disclosed methodology.

The 2025 wave’s other findings, per the October 1, 2025 release: 69% of contractors claim DFARS compliance through self-assessment, but only 30% have completed medium or high validated assessments; just 42% have submitted SPRS scores at all; 17% still report negative scores (110 is the maximum); 89% report having suffered financial, business, or reputational losses from cyber incidents(57% financial, 56% business, 46% reputational); more than 70% call achieving and maintaining compliance “very difficult”; and eight in ten expect to undergo a C3PAO audit by winter 2026.

These are dated survey responses from a commercially sponsored wave, not a direct assessment of every contractor or proof of current booking constraints. Keep survey findings separate from primary-source certificate counts and from an organization’s own assessment-readiness decision.

What is the CMMC timeline?

The CMMC Program rule became effective December 16, 2024. The DFARS acquisition rule became effective November 10, 2025, starting Phase 1, which remains active. The July 13, 2026 suspension halted the Phase II transition; new Level 2 (C3PAO) and Level 3 designations are suspended with no replacement date announced. The original 32 CFR phased schedule is preserved in the historical milestone table below.

Two details from that table that writers get wrong constantly. First, the elapsed time: six years from announcement to enforceable contract clause (2019 to November 10, 2025). Second, the clause numbers. Since February 1, 2026, DoD has used Class Deviation 2026-O0025 — part of the Revolutionary FAR Overhaul — to route NIST SP 800-171 assessment mechanics through deviation clause 252.240-7997 in covered solicitations, removing the old -7019 provision from those packages. But class deviations don’t rewrite the codified regulations: current Acquisition.gov DFARS text still lists 252.204-7019 and 252.204-7020 pending formal rulemaking. The operative clause is the one printed in your solicitation or contract.

Which circulating CMMC statistics could we not verify?

Several widely repeated CMMC numbers could not be traced to any primary source, reproducible denominator, or named methodology. We list them here — with what the verified data says instead — so they stop getting recycled. If you originated one of these figures and can share the underlying methodology, we will evaluate it and update this page.

Why these numbers matter right now

The September 29 source snapshot shows continued issuance of Level 2 certificates while the July 13 suspension keeps the original later-phase procurement milestones from acting as current deadlines. DFARS safeguarding and the applicable self-assessment obligations continue; the current written solicitation or contract determines the requirement for a particular organization. DOJ’s September 1 Honeywell announcement also shows that alleged failures under preexisting NIST SP 800-171 contract requirements remain relevant during the suspension. Historical rulemaking projections, sponsored survey results and a contractor’s own contract decision are different kinds of evidence; keep their dates and definitions visible.

Limitations: what this data does and doesn’t show

We publish the caveats because a statistic without its limits is just a slogan.

• Cyber AB Town Hall figures are official statements at a point in time, not an auditable public registry; monthly deltas can reflect reporting timing as well as issuance.
• DoD’s entity counts and cost figures are regulatory model outputs built on disclosed assumptions (two offerors per solicitation, five subcontractors per prime proposal, preexisting NIST SP 800-171 implementation) — they are the authoritative estimates, not measurements.
• There is no public registry of which contractors must certify, so no true compliance rate can be computed by anyone.
• Survey findings in the readiness section are self-reported and commercially sponsored; we identify the sponsor every time.
• Our enforcement totals are aggregations of DOJ-published amounts under a stated scope definition, not DOJ statistics.
• Clause status in Table 11 reflects a class deviation that remains in effect until rescinded or incorporated through rulemaking; the operative clause is always the one in the contract.
• Derived figures marked as TDCR calculations inherit their inputs’ uncertainty and are rounded as shown.
• Nothing here is legal, financial, or compliance advice — for obligations under a specific contract, read the clause and consult qualified counsel.

Frequently asked questions

Primary sources

• DFARS final rule — Assessing Contractor Implementation of Cybersecurity Requirements, 90 FR 43560 (Sept. 10, 2025)
• CMMC Program final rule, 32 CFR Part 170, 89 FR 83092 (Oct. 15, 2024)
• 32 CFR Part 170, current text (eCFR)
• DoD CIO — About CMMC
• DoD Class Deviation 2026-O0025 — Revolutionary FAR Overhaul Part 40 / DFARS Part 240 (Dec. 18, 2025) and the DARS class deviation index
• DFARS Part 252, current text (Acquisition.gov)
• DoD — State of Competition Within the Defense Industrial Base (Feb. 2022)
• DOJ — Civil Cyber-Fraud Initiative announcement (Oct. 2021) and the settlement releases linked in Table 8
• Cyber AB Town Halls
• Reuters — “New cybersecurity rules for US defense industry create barrier for some small suppliers” (Feb. 20, 2026)
• Federal News Network — Senate NDAA proposes CMMC grant program (June 2026)

This page is educational reference material, produced independently. It is not legal, financial, or compliance advice.