CMMC Level 1 Pass Rates From Early Contractor Groups
Over the past several months, a small number of contractor peer groups have been conducting something unusual: independent cross-verification of their CMMC Level 1 compliance.
These aren't formal assessments. They're informal reviews where contractors in the same supply chain compare their documentation against their actual implementation and share the results within the group. The premise is simple: if your prime contractor's compliance depends on your compliance, everyone has an incentive to make sure the chain actually holds.
The numbers coming out of these groups haven't been published formally. But the pattern is consistent enough across multiple groups to be worth noting.
The general finding is that a significant percentage of contractors who believed they were fully compliant, who had signed their self-assessments and submitted their scores, had material gaps when someone actually checked the implementation against the documentation.
The gaps aren't exotic. They're the same issues appearing repeatedly across different groups. Documentation that doesn't reflect current systems. Practices that were implemented at one point but have since drifted. Controls that exist in policy but were never technically enforced.
What makes this concerning is not that gaps exist. Every compliance framework has an implementation gap. What makes it concerning is that the contractors in question had already signed their attestations affirming full compliance. The gap isn't between "not started" and "compliant." The gap is between "certified compliant" and "actually compliant."
The groups that have gone through this process are not broadly sharing their specific numbers. There's an obvious reason for that: publishing that your group found significant non-compliance after attestation creates legal exposure for every member. The information stays inside the group.
What has leaked out is the general observation: the pass rate, when actually verified, is meaningfully lower than what submitted scores suggest. The federal scoring system, which is the same system contracting officers query during source selection, records whatever the contractor entered. The implication is that a portion of the contractor base is operating under a compliance status that wouldn't survive verification.
The contractors who've been through this process tend to describe it the same way: they thought they were ready until they actually checked. The ones who haven't checked yet are still operating on the assumption that their consultant's work product equals compliance.
That assumption is the gap that matters.