Why Companies Fail CMMC Assessments: The Requirements DoD Sees Missed Most
Forget the '70% fail' statistic. What DoD's own assessment data shows about the NIST SP 800-171 requirements companies miss most, why each one fails, and why most of them can't wait for a POA&M.
You’ll see it in vendor marketing: “70% of companies fail their CMMC assessment.” We tried to trace it. The closest source is a 2025 press release attributing it to a “2024 DoD review,” and we couldn’t find any DoD review that says so. CMMC certification assessments didn’t start until 2025, so a 2024 number couldn’t measure them anyway.
What DoD has published is more useful than a scary percentage. It tells you which requirements organizations actually miss, and the pattern is consistent enough to plan around.
What DoD’s own numbers show
The clearest official figure came when DoD wrote the DFARS assessment rule in 2020: “for the High Assessments conducted on-site by DoD to date, only 36% of contractors demonstrated implementation of all 110 of the NIST SP 800-171 security requirements” (85 FR 61505). Those were contractors who had already self-assessed and posted a score.
The gap between what companies report and what DoD finds has been large. At a 2022 Cyber AB Town Hall, a DCMA presenter was reported to have shared these averages:
As reported from a DCMA presentation at the Cyber AB’s September 2022 Town Hall (Medium Assessments, out of a possible 110).
Those numbers predate CMMC, but the lesson carries over directly: the requirements people believe they meet are not always the ones an assessor finds met.
The ten requirements DoD found unmet most often
DCMA’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) published the ranking below from 117 of its High Assessments between 2019 and 2022. It uses NIST SP 800-171 numbering and scored companies rather than passing or failing them, so read it as a map of where the hard requirements are, not a CMMC pass rate.
- 1
3.13.11FIPS-validated cryptography5 or 33-point case only - 2
3.5.3Multifactor authentication5 or 3No - 3
3.14.1Flaw remediation5No - 4
3.11.1Risk assessment3No - 5
3.11.2Vulnerability scanning5No - 6
3.3.3Review and update logged events1Yes - 7
3.3.4Alert on audit logging failure1Yes - 8
3.3.5Audit record correlation5No - 9
3.6.3Test incident response1Yes - 10
3.4.1Baselines and inventories5No
Why each one trips people up
Encryption that isn’t validated (3.13.11). The most common finding by a wide margin. The requirement isn’t just encryption, it’s FIPS-validated cryptography, and validation belongs to a specific cryptographic module and version on NIST’s validation list, not to a product name. A product that encrypts but runs an unvalidated module is a 3-point finding. No encryption at all is 5 points and can’t go on a POA&M.
Multifactor authentication with gaps (3.5.3). The usual failure isn’t a company with no MFA. It’s MFA that legacy sign-in protocols quietly bypass, or that covers remote users and administrators but not everyone the requirement reaches. Even the partial case is 3 points, and that’s too many for a POA&M.
Recurring work with no dated record (3.14.1, 3.11.1, 3.11.2, 3.3.3). These four share a cause. Flaw remediation asks for time frames to identify, report and correct flaws, not just a patching window. A risk assessment needs dated initial and periodic assessments; a vulnerability scan isn’t one. Scanning needs the dated runs at your defined frequency, not just last week’s report. And reviewing logged events means reviewing which events you log, on a schedule. We cover the calendar behind all four in staying compliant between assessments.
Logs that nobody connects (3.3.4, 3.3.5). Collecting logs is the easy part. Assessors look for an alert when logging itself fails, and for review and analysis that correlates across sources instead of checking each tool on its own.
Plans that were never tested (3.6.3). An incident response plan on paper doesn’t satisfy a requirement to test the capability. The record of the exercise is the evidence.
Baselines confused with inventories (3.4.1). A list of what you own isn’t a baseline of how each thing is configured. Missing firmware and retired assets that never left the list are the other common gaps.
Why most of these end an assessment
Look at the last two columns of the chart. Seven of the ten carry 3 or 5 points. Six of those seven can never go on a POA&M, and the seventh, encryption, only in its 3-point case. Under the CMMC rule, a Conditional status needs a score of at least 88, and every open item must be worth 1 point, with one encryption exception (32 CFR § 170.21(a)(2)). Miss MFA or flaw remediation and the score can be well above 88 and still end with no status at all. (The rules are in CMMC POA&Ms and the 180-day closeout, and the mock assessment post walks through an example where exactly that happens.)
The three 1-point items, logged events, logging-failure alerts and incident response testing, are the only ones on the list a POA&M can carry. That’s a safety net for the small stuff, not a plan.
What changes under CMMC
The DIBCAC list counted findings at the requirement level. CMMC goes one level deeper. Every requirement breaks into assessment objectives, 320 of them at Level 2, and the scoring rule is unforgiving: a requirement is MET only if all of its applicable objectives are. Miss one objective of the six in system auditing and the whole requirement is NOT MET.
That makes the patterns above sharper, not softer. Flaw remediation, for example, has separate objectives for the time frames to identify, report and correct flaws, plus objectives that those things actually happened on time. A company with excellent patching and no written time frame for reporting a flaw still fails the requirement. The objective verbs post explains how to read what each objective asks for.
Why the SSP isn’t on the list
The system security plan (3.12.4) doesn’t appear in DIBCAC’s top ten, and that isn’t because organizations always get it right. Without an SSP there’s nothing to assess against, and under CMMC it’s one of six requirements that can never go on a POA&M (§ 170.21(a)(2)(iii)). A missing or badly out-of-date SSP tends to stop an assessment at the Phase 1 readiness review, before anyone gets to count findings, which is exactly the kind of outcome no published number captures.
What the CMMC numbers show so far
There’s no official CMMC failure rate. The Cyber AB’s September 2026 Town Hall reported 2,362 Final Level 2 certificates and 71 Conditional ones, with 151 assessments in progress. That tells you most certificates issued are Final. It doesn’t tell you how many organizations started an assessment and didn’t finish: an assessment suspended at the Phase 1 readiness review, or postponed by the OSC, doesn’t produce a certificate of any kind, and nobody publishes that count.
Getting ahead of the list
- Check your cryptography against NIST’s validation list, module and version, everywhere CUI is stored or sent.
- Hunt for MFA gaps, especially legacy protocols and service accounts, and make sure it covers everyone the requirement does.
- Write your frequencies down and start the dated records now: risk assessment, scans, flaw time frames, logged-event reviews.
- Connect your logs and alert when logging fails.
- Run an incident response exercise and keep the record.
- Have someone outside your team score you objective by objective before an assessor does. A wrong self-score is the pattern behind every number on this page.
Sources: DCMA DIBCAC, “Top ‘Other Than Satisfied’ Requirements from DIBCAC High Assessments” (December 2022); DFARS interim rule, 85 FR 61505 (September 29, 2020); The Net Effect, report of the Cyber AB Town Hall of September 27, 2022; Cyber AB Town Hall presentation, September 29, 2026; 32 CFR Part 170, § 170.21 and § 170.24.