Defense contractors are reporting their highest cybersecurity compliance scores since tracking began, but confidence in the accuracy of those scores has fallen sharply, according to an annual study conducted by Merrill Research and commissioned by CyberSheath, a cybersecurity compliance services provider. The study, which surveyed 302 defense contractors, found that average Supplier Performance Risk System (SPRS) scores climbed to plus 51 in 2026, up from plus 33 last year. At the same time, just 65% of contractors that submitted an SPRS score said they were extremely or very confident in its accuracy, down from 89% last year and 94% in 2024. SPRS scores measure contractor compliance with National Institute of Standards and Technology (NIST) Special Publication 800-171 security requirements. Those requirements also form the cybersecurity foundation for the Department of Defense’s (DOD) Cybersecurity Maturity Model Certification (CMMC) program. CMMC provides a framework for DOD to verify that defense industrial base (DIB) contractors meet applicable cybersecurity requirements, including through self-assessments and, for some contractors, third-party assessments. According to the report, the latest SPRS results show substantial improvement on paper. The average score had remained negative for three consecutive years, at minus 12 in 2024, minus 15 in 2023, and minus 25 in 2022. SPRS scores can range from minus 203 to a maximum of plus 110. The scores do not represent all respondents, however. Only 67% said they had submitted an SPRS score. The study characterized the disconnect between higher scores and lower confidence as a “central challenge for the DIB,” saying the issue is increasingly about “independently validating whether claimed compliance reflects operational reality.” The report’s findings come as DOD has paused Phase 2 of CMMC, which had been scheduled to take effect on Nov. 10. The department announced a 60-day review of the program on July 13 while keeping