The CMMC class deviation moved the pause and left the gate
If your DoD contract names a CMMC level, your next option exercise is still a gate. Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, is the CMMC class deviation that moved the July 13 suspension of Phase 2 out of a policy memo. It now sits in the DFARS Part 240 clause-insertion rules. Revision 3 left the award and option rules untouched. A contracting officer must still check your posted assessment status before exercising an option or extending a period of performance. A lapsed status requires the officer to withhold both. The third-party certification wall is gone for now. The gate on revenue you already hold is not.
| Field | Answer |
|---|---|
| Signal | Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, writes the Phase 2 suspension into DFARS Part 240 |
| BD implication | Contract administration risk on awards you already hold, not a new buying event |
| Customer | DoD program offices and requiring activities that set CMMC levels |
| Buyer | Not identified. No agency is purchasing anything under this instrument |
| Funding | Not identified. No appropriated, obligated, or requested federal dollars attach |
| Vehicle / path | Not identified. The deviation governs clause content, not a procurement |
| Incumbents / ecosystem | Authorized C3PAOs, CMMC registered providers, MSSPs, and GRC platform vendors serving the defense industrial base |
| Access strategy | Not applicable. The posture is protecting existing awards, not capturing new work |
| Timing | Effective now. Case-by-case clause insertion until November 9, 2028 |
| Confidence | High |
| Pursuit posture | DEFEND |
| Upgrade triggers | A Revision 4, a proposed DFARS rule, or a 32 CFR part 170 amendment setting an earlier restart |
| Downgrade triggers | Rescission of the deviation with the November 2026 transition restored |
Three things are true at once, and the third is the one that changes how you plan:
- Phase 2 third-party certification is suspended, and requiring activities may designate Level 1 (Self) or Level 2 (Self) assessments instead.
- Baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012 was never suspended, and neither was 32 CFR part 170 or clause 252.204-7021 itself.
- The clause rules now carry a date on which insertion stops being a judgment call.
The third is where planning errors will surface. A suspension with a date on it is a different object than a suspension without one.
The pause picked up an expiration date
The July memo froze the phases “until further notice.” Revision 3 replaced that open end with a calendar. DFARS 240.371-5(a), as deviated, splits clause insertion into two regimes at a single boundary.
| Dimension | Until November 9, 2028 | On or after November 10, 2028 |
|---|---|---|
| What triggers clause 252.204-7021 | A program office or requiring activity decides this contractor needs a specific CMMC level | A program office or requiring activity determines the contractor will use its systems to process, store, or transmit FCI or CUI |
| Nature of the trigger | A discretionary policy judgment, made contract by contract | A determination about the data the work touches |
| Practical reach | Narrow, because the July direction pushes requiring activities toward self-assessment | Wider, because the test turns on FCI or CUI rather than on a level judgment |
Calling that boundary the moment CMMC turns automatic overstates what the text does. The difference matters when you plan. Insertion still runs through a requiring-activity determination on both sides of the line. What changes is the question that determination answers. Before the boundary, someone has to decide you need a certification level. After it, they have to decide whether your systems will process, store, or transmit FCI or CUI. I expect the second test to catch more contracts than the first.
Both regimes except acquisitions solely for commercially available off-the-shelf items. A pure COTS line of business sits outside this entirely. For a capture lead pricing a bid that runs past 2028, treat that date as a planning input. Nobody will remind you of it. A contract you compete in late 2028 can carry a clause that a nearly identical contract awarded weeks earlier does not.
The award and option gates were never suspended
Suspending Phase 2 did not soften the enforcement machinery around Cybersecurity Maturity Model Certification status. It narrowed what gets asked for, not what happens when the answer is missing. The deviated rules put the check at three separate moments. DFARS 240.371-3(a)(2) bars award to an offeror without a current status at the required level. DFARS 240.371-4(c) covers option exercise and period-of-performance extension. DFARS 240.371-4(d) catches new system identifiers introduced mid-performance. A mid-contract infrastructure change reopens the question.
The exposure this creates is quiet, because it does not arrive as a compliance notice. It arrives as an option that does not get exercised on schedule.
- Pull every active DoD contract and task order and note which ones contain clause 252.204-7021 and what level each names.
- For each of those, find the next option exercise or period-of-performance extension date.
- Confirm your posted assessment status and affirmation are current for every system identifier tied to that work.
- Ask the cognizant contracting officer, in writing, whether a modification removing the requirement has been issued for that specific contract.
Nothing comes out of your contract on its own
A suspended requirement stays in your contract until someone removes it. Revision 3 directs contracting officers to collaborate with requiring activities on removing or revising CMMC requirements in new and existing solicitations and contracts. It also sets out how that happens:
- A program manager or requiring activity initiates the amendment and sends it to the cognizant contracting officer.
- The contracting officer issues the corresponding solicitation amendment as soon as practicable.
- For an existing contract, the contracting officer removes the requirement by modification, either before the next option period is exercised or at the next scheduled administrative modification.
Every step in that chain depends on a government action taken on your specific contract. Until it happens, the clause in your contract is the clause that governs you. A contractor who reads the suspension as self-applying and lets an affirmation lapse has misread which document controls.
A prime carries one asymmetry the deviation does not touch. This instrument directs government contracting officers. It says nothing to a prime about its own subcontracts. A CMMC flow-down in an existing subcontract stays in force until the prime changes it, which makes relieving a supply base a deliberate decision rather than one that happens on its own.
A class deviation is not a rule, and that cuts both ways
Reading this CMMC class deviation as locking the suspension in is half right. What a class deviation does and does not do sets the ceiling on how much certainty to plan against:
- It binds contracting officers and reaches contract clauses directly, which a chief information officer’s memo does not.
- It went through no notice-and-comment rulemaking, so it is not a codified regulation.
- By its own terms it remains in effect only until rescinded or incorporated into the FAR, DFARS, and DFARS PGI.
- The instruments underneath it, 32 CFR part 170 and clause 252.204-7021, sit on the books unchanged.
The pause is more durable than it was in July, and still reversible without rulemaking. Three revisions in seven months indicate how unsettled this instrument remains.
There is a timing detail underneath all of this. The Department signed Revision 3 on September 3. The reform task force it created on July 13 to rethink the program was due to report to the chief information officer roughly sixty days later, in the second week of September. The clause architecture through 2028 was set before that report was due.
That does not mean the task force has been sidelined. The clause rules and the program review run on separate tracks. Any recommendation the Department adopts still has to travel back through another revision before it reaches a contract. For a compliance lead, that is the difference between watching for the report and watching for the revision that would carry it. Contractors should focus on formal revisions because only a revision changes the clause requirements applied to contracts.
Who is positioned in the assessment market, and who just lost two years
The suppressed demand lands on a set of vendors in the DIB compliance market: authorized C3PAOs, CMMC registered provider organizations, MSPs and MSSPs serving defense suppliers, GRC vendors, and enclave and boundary product vendors. That spending is contractor-internal and private. It never enters federal award reporting, so no public data shows which of them hold what share.
Revision 3 changes performance requirements on contracts already held. Secondarily, it defers contractor-internal compliance spending. This is currently a regulatory or requirements signal, not yet a validated federal contracting opportunity.
Different readers do different things with this:
- A small business or mid-size defense supplier protects option exercises and stops treating certification as an imminent cost.
- A prime decides, on purpose, whether to relieve its subcontractors of a flow-down that no longer binds the government.
- An assessment or compliance vendor reprices around self-assessment support and 800-171 baseline work, because mandatory third-party demand is now two years out.
- A new entrant takes the self-assessment path, treating a voluntary certification bought today as redesign risk against a successor construct nobody has published.
What would change the posture is a Revision 4, a proposed DFARS rule, or an amendment to 32 CFR part 170 that sets a restart earlier than November 2028. Watch the task force recommendations the Department adopts, not the report itself. Adoption is what reaches a clause.
FAQ
What is DFARS Class Deviation 2026-O0025, Revision 3?
It is an acquisition-policy instrument signed September 3, 2026. It directs DoD contracting officers to use a revised DFARS Part 240 in place of the codified text. The instrument supersedes Revision 2 from July 16, 2026, and carries the CMMC Phase 2 suspension into the clause-insertion rules.
Is CMMC still required if Phase 2 is suspended?
Yes, in the forms that were never suspended. Solicitations may still require Level 1 and Level 2 self-assessments. Baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012 continues. A CMMC level already written into your contract governs that contract until someone modifies it.
Are contracting officers actually removing these requirements from existing contracts?
No public dataset reports how often contracting officers execute the directed modifications. The deviation sets the trigger as the next option period or the next scheduled administrative modification. The pace therefore follows each contract’s own administration calendar, not a department-wide date.
Which offices decide whether a CMMC requirement comes out of my contract?
The requiring activity or program manager starts the amendment. The cognizant contracting officer then executes it. The policy comes from the Department of War chief information officer, and reaches contracts through the acquisition policy office that signed the deviation.
What happens to CMMC on November 10, 2028?
The condition for inserting clause 252.204-7021 changes. Before that date, a requiring activity decides whether a contractor needs a specific CMMC level. On and after it, the deciding question becomes what data the contract work touches.
Could the suspension end before 2028?
Yes. The deviation stays in effect only until it is rescinded or folded into the FAR and DFARS, and it has already been revised three times since February 2026. Adopted task force recommendations or a new rulemaking could reset the schedule.
Does the suspension relieve my subcontractors of CMMC flow-downs?
Not by itself. The deviation directs government contracting officers. A flow-down in an existing subcontract remains a matter between you and your subcontractor until you modify it.
