On September 3, the Office of the Assistant Secretary of War for Acquisition and Sustainment issued Class Deviation 2026 O0025, Revision 3, updating the contracting rules that implement CMMC alongside unrelated supply chain and foreign ownership provisions. It started circulating quickly, and read on its own, out of context, it has understandably raised questions about where CMMC stands.
We want to be direct about the most important point first.
Nothing About CMMC Has Changed
Revision 3 is not a new, concrete decision on CMMC. Acquisition and Sustainment is formalizing what the DoW CIO already put in place on July 13 when she paused CMMC Phase 2. Class Deviation Revision 2, issued July 16, did that first. Revision 3 carries that same language forward, word for word, in the CMMC section of the clause. We compared it directly, line by line, against Revision 2 and the original clause text. Nothing was added, removed, or softened. We are still in the same boat we described in July, we are still waiting.
With that as the foundation, here is our broader read on what this revision does and does not mean.
The review is not over.
The CMMC Reform Task Force was given 60 days from the July 13 memo to deliver its recommendations, a window that is closing within days of this writing. A report to the DoW CIO starts a decision process, not the end of one. It still has to be acted on, and any actual change to the underlying rule at 32 CFR Part 170 would require its own formal rulemaking after that. We do not know what the Task Force will recommend, and nothing in this revision tells us. We remain in a holding pattern.
The only two facts we can point to today.
We want to be careful here to separate what the text actually says from what we expect to happen, because those are different things.
The July 13 memo paused the Phase 2 transition that was originally set for November 2026, and it did not give a new date for when that transition resumes. This class deviation does not do the pausing, it directs contracting officers (CO’s) on what to actually do about a pause that is already in effect: remove or revise CMMC requirements in new and existing solicitations, amend contracts before the next option exercise, and apply the baseline NIST SP 800-171 Rev. 2 requirement under DFARS 252.204-7012 in the meantime. Separately, and unaffected by any of this, the rule’s original Phase 4 language, full implementation with no program office discretion, still sits in the clause exactly as written since November 2025, tied to November 10, 2028. Nothing in this class deviation extended that date or moved it, it was already there.
Phase 1 does not mean Level 1.
Sharing the number “1” is most of why people mix them up. Level describes how sensitive the information on a given contract is, and which security tier applies to it:
- Level 1 for Federal Contract Information
- Level 2 for Controlled Unclassified Information
- Level 3 for the most sensitive CUI.
Phase describes the government’s own rollout schedule for enforcing those Levels over time, Phase 1 through Phase 4, and it governs how and when a requirement gets assessed, not which Level applies to your contract.
We are currently in Phase 1 of that rollout. Phase 1 covers both Level 1 self assessment and Level 2 self assessment with affirmation in the Supplier Performance Risk System (SPRS), depending on what your specific contract requires. Being in Phase 1 of the schedule does not mean your obligation is limited to Level 1 of the framework. If your contract involves CUI, you are very likely operating under a Level 2 self assessment obligation right now, active and enforced, independent of anything happening with third party certification.
Primes can move ahead of the government’s own timeline.
Everything above describes what the federal government can require directly, and that is what is currently paused. It does not describe what your prime can require of you. A prime’s flow-down requirements are its own business decision, not a government mandate, and a prime is free to hold its supply chain to a higher bar than the government currently requires, on its own schedule, whenever it chooses to. We have already seen some do this. Primes requiring Level 2 C3PAO certification from subcontractors today are not signaling that the federal pause has ended, they are making their own call.
When will the government require CMMC?
This is the question we hear most about the federal side specifically, and the honest answer has not changed since July. There is no fixed date for when the government’s third-party certification requirement returns to solicitations. At the time of this writing, we would not treat any date currently in circulation, including November 2028, as one. That will happen once the Task Force’s recommendations have been acted on, not before. Watch for movement at the DoW CIO level and in the Federal Register, not for another class deviation. What your prime requires of you, as noted above, is a separate question entirely, and can happen on their timeline regardless of where the federal one stands.
Our Recommendation:
Continue. Whatever emerges from this review, a revised framework, a restart of Phase 2, or something restructured, being assessment ready positions your organization ahead of the field rather than behind it. Pausing active work risks losing ground on a readiness timeline that typically runs 12 to 18 months, particularly if requirements return with a shorter runway than the original schedule provided. We also want to flag a risk we think is important. Treating this revision as a reason to delay work required under DFARS 252.204.7012, whether that work is CMMC specific or not, carries real exposure, particularly for organizations that continue representing themselves as compliant without maintaining the underlying practices required to support that representation.
We are monitoring the Task Force’s review closely and will share updates as they become available.
Do you have specific questions about how this affects your certification timeline or contracts? Contact us.
