The July 13, 2026 suspension of CMMC Phase 2 was a memorandum from the DoD Chief Information Officer. A memo tells the Department what its policy is. It does not tell a contracting officer what to write in a solicitation. On September 3, 2026, a class deviation did that, and the difference matters more than the headlines suggested.
What a class deviation is
The Defense Federal Acquisition Regulation Supplement is a regulation. Changing its text takes a rulemaking with notice and comment. A class deviation is the mechanism the Department uses to direct its contracting officers to depart from the DFARS text for a class of contracts without waiting for that rulemaking. Deviations are numbered, signed, and normally published on the Defense Pricing, Contracting and Acquisition Policy class deviations page (2026-O0025 was not listed there when we checked on September 22, 2026), and they bind contracting officers the day they are signed.
Deviation 2026-O0025 is the CMMC deviation. Revision 2, signed July 16, 2026, implemented the July 13 memorandum. Revision 3, signed September 3, 2026, carries that direction forward and continues the suspension without a new date.
What Revision 3 did
On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment.
The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set.
What it directs contracting officers to do
- New solicitations and contracts: third party (C3PAO) assessment requirements are not included. Level 1 and Level 2 requirements may be satisfied through self assessment.
- Existing contracts: Kiteworks, Sera-Brynn and Redspin (sources below) read the deviation as directing contracting officers to remove third party assessment requirements by modification before the next option is exercised or at the next administrative modification; Pivot Point Security reads it as requiring modification of existing contracts. Until that modification is signed, the clause as written stays on that contract, so read your own contract and ask your contracting officer.
- Everything else in DFARS 252.204-7012: untouched. Safeguarding, incident reporting and the NIST SP 800-171 Rev 2 baseline are exactly what they were.
What never paused
| Obligation | Status after September 3, 2026 |
|---|---|
| Phase 1 self assessment requirements on applicable contracts, in force since November 10, 2025 | In force. Unchanged. |
| DFARS 252.204-7012 and the incident reporting it requires | In force. Unchanged. |
| The 110 requirements of NIST SP 800-171 Revision 2 | In force. Unchanged. |
| The SPRS score and its posting | In force. Unchanged. |
| The annual affirmation signed by your senior official (32 CFR 170.22) | In force. Unchanged. |
| False Claims Act exposure for a knowingly false affirmation | In force. Unchanged. |
| 32 CFR Part 170, the program rule, and the 48 CFR DFARS acquisition rule, both still codified | In force. Unchanged. |
Level 2 today
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
Two tracks, one body of work. The self assessment is filed in SPRS with the annual affirmation. Certification by a C3PAO happens only where a solicitation names it, and the same SSP, the same scope and the same evidence serve both, so the readiness work is identical either way. The Level 2 page walks it.
Why a deviation and not a rule
The program rule, 32 CFR Part 170, is still codified and still provides for third party certification. The Department has not amended it. A deviation lets contracting officers act now while the CMMC Reform Task Force review runs. That is also why a Task Force report, on its own, changes nothing for a contractor: a report is advice to the Department. Only a further deviation, a change to the DFARS text, or an amendment to 32 CFR Part 170 changes a contract obligation. We will update this post and the state of CMMC timeline when one lands.
What to do now
If you handle FCI only (Level 1)
Nothing changed for you. Level 1 has always been self assessed and self affirmed. Keep the 15 safeguarding requirements met, keep the evidence, and keep the annual affirmation on the calendar.
If you handle CUI (Level 2)
Self assess. Score all 110 requirements honestly, keep the POA&M within the rules, post the score in SPRS, and have your senior official affirm. If a solicitation ever names certification, the same record goes to a C3PAO. Do not let the pause become an excuse to let the SSP drift: DFARS 252.204-7012 never paused, and a knowingly false affirmation is still False Claims Act exposure.
Dates
| Date | What it is |
|---|---|
| Dec 16, 2024 | 32 CFR Part 170, the CMMC program rule, effective. Still in force. |
| Nov 10, 2025 | 48 CFR DFARS acquisition rule effective, Phase 1 begins. Still in force. |
| Jul 13, 2026 | On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memorandum suspending CMMC Phase 2 and opening a top to bottom review of the program, with a CMMC Reform Task Force to report within 60 days and a Request for Information closing August 14, 2026. |
| Jul 16, 2026 | Class deviation 2026-O0025 Revision 2 implements the memorandum. |
| Aug 14, 2026 | Responses to the Reform Task Force Request for Information due. |
| Sep 3, 2026 | Class deviation makes the suspension binding on contracting officers |
| Sep 11, 2026 | Reform Task Force report date. A report alone changes no contract obligation. |
Sources
- Defense Pricing, Contracting and Acquisition Policy, DFARS class deviations page (where deviations are normally published; 2026-O0025 was not listed there when checked on September 22, 2026)
- Kiteworks, DFARS Class Deviation 2026-O0025, Revision 3: What It Actually Changes for CMMC
- Pivot Point Security, Revision 3 of DARS Class Deviation 2026-O0025: What Defense Contractors Need to Know (September 8, 2026)
- Fortreum, CMMC Update: What DoD Class Deviation 2026-O0025 Means (September 14, 2026)
- Redspin, Class Deviation Revision 3: Still in the Holding Pattern
- Sera-Brynn, CMMC Class Deviation 2026-O0025 Revision 3: The Phase 2 Suspension Reaches the Contract File (September 9, 2026)
- CyberZ, The CMMC Suspension Is Now a Regulation. Here Is What Changed on September 3 (September 10, 2026)
The deviation text itself is the primary source. It is normally published on the DPCAP class deviations page, which did not list 2026-O0025 when we checked on September 22, 2026, so the write ups are cited for their readings of it, the contract modification direction in particular; where they and the deviation text differ, the deviation text governs. Clause numbers are deliberately not quoted here until read from the deviation itself.