What Contractor Peer Groups Are Finding About CMMC Compliance
The most useful CMMC compliance data in the current market isn't coming from consultants, assessors, or the government. It's coming from contractor peer groups, and it isn't being published.
Contractor peer groups formed organically in the defense supply chain. A prime contractor depends on its subcontractors' compliance. A subcontractor depends on its own understanding of the requirements. When several contractors in the same chain realized they all had the same uncertainty, some of them started comparing notes.
The format is informal. Contractors in the group share their documentation, walk through their actual system configurations, and compare what they submitted to the federal scoring system against what their systems are doing right now. It's not an audit. It's a reality check.
The results of these reality checks have not been kind.
The pass rates, when contractors actually verify against implementation rather than documentation, are consistently lower than what the submitted scores suggest. The gap isn't marginal. It's large enough that several groups have stopped accepting new members, because the liability of knowing about non-compliance in your supply chain creates its own legal exposure.
The specific findings vary by group, but the pattern is consistent: the gaps are in the areas contractors assumed were already handled. Controls that exist in documentation but not in practice. Policies written for environments that no longer match how the organization actually operates. The open system problem in its most basic form, showing up in places nobody thought to check.
Each of these gaps individually might seem minor. But each one represents a practice that was certified as implemented when the self-assessment was signed. Together, they represent a compliance posture that the contractor's own peer group wouldn't validate.
The groups that have been through this process describe the same trajectory. First, disbelief: "we thought we were ready." Then, quiet remediation, fixing the gaps without alerting anyone outside the group. Then, a realization that point-in-time fixes don't solve the underlying problem because the gaps reform within weeks.
The contractors who've emerged from this process with the most confidence are the ones who found a way to lock their verification, to make compliance something their systems enforce continuously, not something their employees maintain manually.
The rest are watching the gaps reappear and wondering how long they have before someone outside the group decides to check.