Cybersecurity Compliance Research & Benchmark Data | Lazarus Alliance

Published 2026 reports include:

• 2026 CMMC Assessment Benchmark Report (N = 47 completed Level 2 C3PAO assessments)
• 2026 FedRAMP Assessment Benchmark Report (N = 38 completed FedRAMP 3PAO assessments)
• 2026 SOC 2 Audit Benchmark Report (N = 75 completed Type 1 and Type 2 examinations)
• 2026 CJIS Assessment Benchmark Report (N = 28 completed CJIS Security Policy assessments)
• 2026 LADMF Assessment Benchmark Report (N = 18 completed NTIS ACAB assessments)

Coming soon: 2026 ISO 27001 Certification Benchmark Report and 2026 NIST 800-53 Assessment Benchmark Report.

Each report aggregates completed assessments performed by Lazarus Alliance during the stated reporting period (currently January 2025–June 2026). Only completed formal assessments, examinations, or ACAB attestations are included. Readiness workshops, gap analyses, and documentation-only reviews are excluded unless a report explicitly states otherwise.

Organizational identifiers, system names, contract numbers, ORI numbers, agency sponsors, and proprietary details are removed before publication.

Yes. All published research uses aggregate, anonymized statistics. Individual client identities, assessment outcomes, and proprietary evidence remain confidential. Reports are licensed for citation of aggregate statistics with attribution; they do not disclose client-level data.

No. The reports are observational. They describe patterns across completed engagements and do not guarantee future performance, certification outcomes, authorization results, or timelines.

Individual results vary based on preparation quality, boundary complexity, evidence maturity, inheritance, control operation, and applicable program or agency review processes.

Lazarus Alliance publishes only aggregate, anonymized statistics after assessments are complete. The research does not identify assessed organizations and does not replace or influence individual assessment judgments.

Assessment independence is maintained under the applicable professional and accreditation requirements, including ISO/IEC 17020 (C3PAO / FedRAMP 3PAO), AICPA standards (SOC examinations), Cyber AB requirements, FedRAMP 3PAO requirements, and NTIS ACAB obligations for LADMF work.

The current reports cover completed assessments from January 2025 through June 2026 and were published in August 2026. Each report lists its version number, sample size, and methodology on the report page.

Yes. Aggregate statistics may be cited with attribution. Recommended short citations:

• Lazarus Alliance (2026). 2026 CMMC Assessment Benchmark Report (N=47).
• Lazarus Alliance (2026). 2026 FedRAMP Assessment Benchmark Report (N=38).
• Lazarus Alliance (2026). 2026 SOC 2 Audit Benchmark Report (N=75).
• Lazarus Alliance (2026). 2026 CJIS Certification Benchmark Report (N=28).
• Lazarus Alliance (2026). 2026 LADMF Certification Benchmark Report (N=18).

Full citation formats appear on each report page.

Across the published datasets, additional evidence requests were common: 89% of CMMC Level 2 assessments, 95% of FedRAMP assessments, 88% of SOC 2 examinations, 86% of CJIS assessments, and 83% of LADMF assessments.

The most frequent causes are screenshots without context, policies without operational proof, incomplete log samples, unsupported inheritance claims, outdated inventories or baselines, and evidence that is not mapped to the specific control or practice being tested. Volume alone is a weak predictor of efficiency. Quality and mapping matter more.

Yes. ISO 27001 and NIST 800-53 benchmark reports are listed as coming soon. Additional framework reports and updated editions may be published as datasets grow. Check this page for new releases.