CMMC Statistics 2026: Certification Counts, Costs, Small Business Impact & Enforcement Data

Key CMMC statistics at a glance

What this shows — and what it doesn’t

These figures establish the program’s scale (roughly one-third of a million entities), its cost floor (six figures for a small business before a single control is implemented), its early trajectory (about 1.2% of the projected Level 2 population certified so far), and its legal teeth ($39.0 million in defense-related False Claims Act settlements before any certificate was ever required).

They do not show a compliance rate — no public registry says who is compliant and who isn’t. They do not show total compliance cost — DoD deliberately excluded implementation from its estimates, for reasons we explain below. And they do not show an assessment backlog, because no primary-source backlog measurement exists anywhere. Where the data ends, we say so.

How we built this page

We read both CMMC rules in the Federal Register — the program rule (32 CFR Part 170) and the acquisition rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) — along with the current clause text on Acquisition.gov, DoD’s published reports and CIO guidance, the February 2026 class deviation memo, Department of Justice settlement announcements, Cyber AB Town Hall disclosures, and original reporting from Reuters and Federal News Network. We recomputed every number independently and checked it against its stated source.

Every statistic carries one of three evidence grades, or a calculation label:

Claims that fail all four categories — no source, no denominator, no methodology — do not appear as facts anywhere on this page. They appear in one place only: the “claims we could not verify” section near the end.

Two related references in this section update on their own schedules: our CMMC certification tracker (monthly, after each Cyber AB Town Hall) and our cybersecurity enforcement ledger (event-driven, as DOJ announces resolutions). Figures on this page are snapshots from those datasets as of the verification date above.

How to cite this page

Every statistic on this page, with its source, evidence grade, and verification date, is available as a CSV at /research/cmmc-statistics/cmmc-statistics-ledger.csv — no email required.

How many companies need CMMC?

DoD estimates 337,968 unique entities — prime contractors and subcontractors combined — will be subject to CMMC requirements by Year 4 of the phased rollout, according to the DFARS final rule published September 10, 2025. Of those, 229,818 (68%) are small entities. The requirement applies to any contractor whose information systems process, store, or transmit federal contract information (FCI) or controlled unclassified information (CUI) under a DoD contract, with a carve-out for contracts solely for commercially available off-the-shelf (COTS) items.

How DoD counted.The department doesn’t actually track unique offerors, and it has no contractual relationship with subcontractors at all. So the rule’s analysis works from assumptions: roughly 28,164 annual solicitations, an assumed average of two offerors each (56,328 prime offerors), and an assumed five subcontractors per prime proposal. Multiply through and you reach 337,968 unique entities. That means the headline number is a model output, not a census — a distinction that matters when extrapolating.

The phase-in is deliberately back-loaded for small businesses. The rule projects 1,104 small entities affected in Year 1, 5,565 in Year 2, 18,554 in Year 3, and the full 229,818 by Year 4 and beyond.

One precision note writers routinely miss: CMMC certifies information systems, not companies. Each assessed system receives a CMMC unique identifier (UID) in SPRS, DoD’s contractor-performance database, and a single company can hold several. The Cyber AB reinforced this at its May 2026Town Hall in guidance on joint ventures, which must identify every UID used in contract performance. “Companies certified” and “certificates issued” are close approximations, not identical measures.

How many companies need CMMC Level 2 certification?

The DFARS final rule projects 118,289 entities will require Level 2 certification by a Certified Third-Party Assessment Organization (C3PAO) — an independent assessor authorized by the Cyber AB — by Year 4 of implementation. That is 35% of all impacted entities. A much smaller group, about 6,759 entities (2%), will be allowed to self-assess at Level 2 for lower-risk CUI. The two paths are frequently collapsed into one “Level 2” number; they shouldn’t be.

About that “80,000” figure you keep seeing.A claim that “roughly 80,000 contractors need Level 2 certification” circulates widely. We could not pin that exact figure to current rule text. What we canreproduce: apply the rule’s 35% Level 2 (C3PAO) share to the 229,818 small entities and you get 80,436 small entities in the certification population (TDCR calculation) — almost certainly the origin of the ~80,000 shorthand. The correct all-entity figure is 118,289.

How many companies are CMMC certified right now?

As of the May 2026 Cyber AB Town Hall, 1,391 organizations hold a final Level 2 certificate, with 47 conditional certificates open and 140 assessments in progress. That is roughly 1.2% of the 118,289 entities DoD projects will need Level 2 certification (1,391 ÷ 118,289; TDCR calculation). Current figures update monthly in our certification tracker.

That works out to an average of about 155 new final certificates per month in 2026 ((1,391 − 773) ÷ 4 months, January through May; TDCR calculation).

The finding nobody else has published: the market is running ahead of DoD’s own model. The program rule projected 135 C3PAO-led certification assessments in Year 1, 673 in Year 2, 2,252 in Year 3, and 4,452 in Year 4 — 808 cumulative through the first two years. Actual final certificates reached 1,391 by May 2026, about seventeen months after the program rule took effect and only partway into Year 2. Measured against DoD’s own curve, the defense industrial base is ahead of model on early adoption.

Failure data is thin but real: the Cyber AB disclosed in July 2025 that 8 organizations had failed a Level 2 assessmentto that point, while noting unreported false starts likely exist. And conditional status — certification with an open Plan of Action and Milestones (POA&M), the 180-day punch list for unmet requirements — covers only about 3% of certified organizations (47 of 1,438 total certificates; TDCR calculation).

What are the official CMMC cost statistics?

DoD’s official estimate for a small entity’s Level 2 certification is $101,752 initially and $104,670 over the full three-year cycle — and that figure covers only assessment, certification, and affirmation activity. It excludes implementation and remediation entirely. Both numbers come from the CMMC Program final rule’s regulatory analysis.

What DoD’s $104,670 estimate does not include

The rule states that implementation costs are not attributed to CMMC because the underlying requirements already exist: the basic safeguarding clause at FAR 52.204-21 has applied since June 15, 2016, and DFARS 252.204-7012 required full implementation of NIST SP 800-171 — the 110-requirement federal standard for protecting CUI — by December 31, 2017. In DoD’s accounting, a contractor handling CUI should have absorbed those costs years ago. CMMC merely charges you to prove it.

The proof that this was a choice, not an oversight: at Level 3, where the rule adds genuinely new requirements drawn from NIST SP 800-172, DoD did count engineering costs — an estimated $2.7 million in nonrecurring and $490,000 in recurring engineering costs for a small entity. The department costs implementation when requirements are new and excludes it when they’re preexisting. That accounting boundary is the single most useful thing to understand about every CMMC cost figure in circulation.

The gap between the certification paths is itself instructive: a small entity’s three-year Level 2 certification estimate runs $67,474 more than the self-assessment path($104,670 − $37,196; TDCR calculation). For scale, the rule’s own analysis puts the DFARS acquisition rule’s total cost at $344.9 million in present value over ten years at a 3% discount rate ($329.1 million public, $15.8 million government).

What contractors actually budget is a different question — and a different grade of evidence. In a PreVeil survey of more than 2,000 defense contractors (sponsor: PreVeil, a compliance platform vendor), 70% had budgeted less than the DoD estimate for Level 2 certification. The 2025 Merrill Research survey commissioned by CyberSheath, a CMMC managed services provider, found annual compliance budgets averaging nearly $50,000. We publish these as what they are — named surveys with disclosed sponsors (C) — not as official figures.

Is there enough C3PAO capacity — and is there a backlog?

As of the May 2026 Cyber AB Town Hall there were 104 authorized C3PAOs, up from 97 in January, alongside 759 Certified CMMC Assessors (CCAs) as of March and a further 15% jump in CCAs from April to May. No primary-source measurement of an assessment backlog exists — from the Cyber AB, DoD, or anyone else — and the available capacity data points the other direction.

Beyond the assessor corps: Registered Practitioners numbered roughly 2,000 and Registered Provider Organizations 378 as of early 2026, four non-US C3PAOs were moving through authorization, and credentialing operations transferred from the Cyber AB’s CAICO arm to ISACA, with the transition completing April 1, 2026. A March 2026analysis by Secureframe, which pulled all 5,732 active Cyber AB Marketplace entries via the marketplace’s public API, counted 3,607 unique entities holding at least one ecosystem role.

Two scale figures, clearly labeled as arithmetic: if the DFARS-rule projection materializes, the current assessor base implies about 1,137 organizations needing certification per authorized C3PAO(118,289 ÷ 104), and the Level 2 certification population is 26.6 timesDoD’s own projected Year 4 annual assessment volume (118,289 ÷ 4,452). Neither is a backlog claim — they describe the size of the mountain, not the length of the queue.

As for the queue itself: Secureframe’s capacity model estimated a theoretical ceiling around 1,500 assessments per month if every CCA ran two solo assessments monthly — against roughly 178 certificates actually issued in March 2026. On the numbers available, the binding constraint is organizational readiness, not assessor headcount: assessors report spending much of their time on advisory work and mock assessments because organizations arrive unprepared. The “24–30 month backlog” figure appears in our unverified-claims section below, where it belongs.

How does CMMC affect small businesses?

Small entities are 68% of everyone CMMC touches — 229,818 small entities, including prime contractors and subcontractors — and roughly 80,436 of the projected Level 2 certification population (TDCR calculation from the rule’s distribution). The program’s costs land on the smallest balance sheets in the defense supply chain, and they land on a population that was already shrinking.

The pre-CMMC context comes from DoD itself. The department’s February 2022 State of Competition report found the number of small businesses in the DIB shrank by more than 40% over the preceding decade— even as DoD grew small-business R&D spending 83% and manufacturing spending 28% over the same period. Then-Deputy Secretary Kathleen Hicks warned the department could lose an additional 15,000 suppliers over the following ten years on the existing trend. More companies spent more money and still left. CMMC adds a six-figure gate on top of that trend.

The early evidence on how suppliers are responding is journalistic, and we grade it accordingly (grade C: original reporting, attributed). Reuters reported on February 20, 2026 that the new rules are leading some small suppliers to rethink military work: three aerospace companies each told Reuters they have suppliers who will not undergo the CMMC audit; the president of one U.S. firm said half of its suppliers had not indicated whether they will comply; and one Canadian supplier executive put his combined EU/US compliance cost at about C$500,000 (roughly US$365,000). The Aerospace Industries Association told Reuters that accumulating regulatory costs are forcing some member firms to “reconsider — if not exit” the defense marketplace. Reuters also cited 2022 House Small Business Subcommittee data that 88% of aerospace firms are small businesses. These are documented examples and on-record statements — not an exit rate. No verified exit-rate statistic exists (see the unverified-claims section).

Assistance is starting to move. The Senate Armed Services Committee’s FY2027 defense authorization bill would require DoD to establish a CMMC assessment grant program by July 1, 2027 — up to $100,000 per grant, capped at $50 million total — for small businesses and new entrants, prioritizing companies that have never held a DoD contract. It is a proposal, not law; Federal News Network first reported the provision in June 2026. Already real: the Army’s NCODE program awarded eight contracts worth a collective $49 million to provide small businesses a secure cloud enclave for meeting the requirements CMMC evaluates. A previously proposed federal tax credit (30% of costs, up to $50,000, for firms under 50 employees) has not passed.

What CMMC enforcement actions have happened?

Since the Department of Justice launched its Civil Cyber-Fraud Initiative in October 2021, we count 13 publicly announced False Claims Act resolutions involving federal cybersecurity requirements, totaling $60,393,500 — of which $38,986,778 across 10 resolutions involved defense-related contracts. Not one of them enforces CMMC certification itself. Every case enforces the preexisting obligations — NIST SP 800-171, DFARS 252.204-7012, FAR 52.204-21, and truthful self-reporting in SPRS — that CMMC now exists to verify. The False Claims Act (FCA) is the federal statute penalizing false claims for government payment; most of these cases began as qui tamsuits, meaning a whistleblower filed on the government’s behalf and shares in the recovery.

TDCR calculation: 13 public DOJ cybersecurity-related FCA resolutions identified, $60,393,500 total; defense-related subset, 10 resolutions, $38,986,778.

The case that explains why third-party verification exists. On June 18, 2026, DOJ announced that LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 over two Navy contracts spanning May 2021 to March 2025. The company had assessed itself a perfect 110 in SPRS. When the Defense Contract Management Agency assessed the same environment, it scored −170— near the bottom of the −203-to-110 scale. Half the settlement, $253,572, is restitution. A 280-point gap between self-report and government assessment, in one sentence, is the entire argument for CMMC.

Two more patterns worth a writer’s attention. The Raytheon/Nightwing resolution held Nightwing liable as successorfor conduct predating its acquisition of Raytheon’s cyber business — acquirers now inherit cyber-FCA exposure. And the Georgia Tech resolution paid whistleblowers $201,250 of the $875,000 recovery, a reminder of where these cases originate. Separately, the Administrative False Claims Act (December 2024) now lets agencies pursue smaller cyber misrepresentations directly, without a DOJ suit.

How ready is the defense industrial base?

The most complete public multi-year readiness series we found — Merrill Research’s annual survey commissioned by CyberSheath, a CMMC managed services provider — found only 1% of surveyed contractors felt fully prepared for CMMC assessments in 2025, down from 8% in 2023 and 4% in 2024. Over the same series, the median self-reported SPRS score rose from 20 in 2022 to 60 in 2025. This is self-reported survey data with a commercial sponsor, and we grade it accordingly. We publish it anyway because it is the only multi-year readiness series with a named research firm and disclosed methodology.

The 2025 wave’s other findings, per the October 1, 2025 release: 69% of contractors claim DFARS compliance through self-assessment, but only 30% have completed medium or high validated assessments; just 42% have submitted SPRS scores at all; 17% still report negative scores (110 is the maximum); 89% report having suffered financial, business, or reputational losses from cyber incidents(57% financial, 56% business, 46% reputational); more than 70% call achieving and maintaining compliance “very difficult”; and eight in ten expect to undergo a C3PAO audit by winter 2026.

Read alongside the certification data above, the readiness picture is coherent: certificates are being issued faster than DoD modeled, by the prepared sliver of the market, while the survey data suggests the median contractor remains far from assessment-ready. Both facts should appear in any honest account.

What is the CMMC timeline?

The CMMC Program rule became effective December 16, 2024. The DFARS acquisition rule became effective November 10, 2025, starting Phase 1, which DoD lists as running through November 9, 2026. Phase 2 begins November 10, 2026 — Level 2 (C3PAO) certification in applicable solicitations and contracts, generally as a condition of award, with DoD discretion to delay the requirement to an option period. Full implementation arrives November 10, 2028.

Two details from that table that writers get wrong constantly. First, the elapsed time: six years from announcement to enforceable contract clause (2019 to November 10, 2025). Second, the clause numbers. Since February 1, 2026, DoD has used Class Deviation 2026-O0025 — part of the Revolutionary FAR Overhaul — to route NIST SP 800-171 assessment mechanics through deviation clause 252.240-7997 in covered solicitations, removing the old -7019 provision from those packages. But class deviations don’t rewrite the codified regulations: current Acquisition.gov DFARS text still lists 252.204-7019 and 252.204-7020 pending formal rulemaking. The operative clause is the one printed in your solicitation or contract.

Which circulating CMMC statistics could we not verify?

Several widely repeated CMMC numbers could not be traced to any primary source, reproducible denominator, or named methodology. We list them here — with what the verified data says instead — so they stop getting recycled. If you originated one of these figures and can share the underlying methodology, we will evaluate it and update this page.

Why these numbers matter right now

Phase 2 begins November 10, 2026— about four months from this page’s verification date. From that point, Level 2 (C3PAO) certification appears in applicable solicitations, generally as a condition of award, and the gap between 1,391 certified organizations and a six-figure projected population stops being an abstraction and starts deciding who can bid. Congress is negotiating whether to subsidize the on-ramp (the FY2027 grant proposal). DOJ announced six defense-related cybersecurity FCA resolutions in 2025 alone and has already added LOGZONE in June 2026 — and that case shows exactly what happens when a self-reported score meets a government assessment. Every number on this page moves — which is why each one carries a date, and why the page carries a verification stamp.

Limitations: what this data does and doesn’t show

We publish the caveats because a statistic without its limits is just a slogan.

• Cyber AB Town Hall figures are official statements at a point in time, not an auditable public registry; monthly deltas can reflect reporting timing as well as issuance.
• DoD’s entity counts and cost figures are regulatory model outputs built on disclosed assumptions (two offerors per solicitation, five subcontractors per prime proposal, preexisting NIST SP 800-171 implementation) — they are the authoritative estimates, not measurements.
• There is no public registry of which contractors must certify, so no true compliance rate can be computed by anyone.
• Survey findings in the readiness section are self-reported and commercially sponsored; we identify the sponsor every time.
• Our enforcement totals are aggregations of DOJ-published amounts under a stated scope definition, not DOJ statistics.
• Clause status in Table 11 reflects a class deviation that remains in effect until rescinded or incorporated through rulemaking; the operative clause is always the one in the contract.
• Derived figures marked as TDCR calculations inherit their inputs’ uncertainty and are rounded as shown.
• Nothing here is legal, financial, or compliance advice — for obligations under a specific contract, read the clause and consult qualified counsel.

Frequently asked questions

Primary sources

• DFARS final rule — Assessing Contractor Implementation of Cybersecurity Requirements, 90 FR 43560 (Sept. 10, 2025)
• CMMC Program final rule, 32 CFR Part 170, 89 FR 83092 (Oct. 15, 2024)
• 32 CFR Part 170, current text (eCFR)
• DoD CIO — About CMMC
• DoD Class Deviation 2026-O0025 — Revolutionary FAR Overhaul Part 40 / DFARS Part 240 (Dec. 18, 2025) and the DARS class deviation index
• DFARS Part 252, current text (Acquisition.gov)
• DoD — State of Competition Within the Defense Industrial Base (Feb. 2022)
• DOJ — Civil Cyber-Fraud Initiative announcement (Oct. 2021) and the settlement releases linked in Table 8
• Cyber AB Town Halls
• Reuters — “New cybersecurity rules for US defense industry create barrier for some small suppliers” (Feb. 20, 2026)
• Federal News Network — Senate NDAA proposes CMMC grant program (June 2026)

This page is educational reference material, produced independently. It is not legal, financial, or compliance advice.