CMMC Class Deviation: The Phase 2 Pause Is Now in the Rulebook

When MacZine covered the CMMC Phase 2 suspension in July, and then the subcontract flow-down it left behind, the pause was a memo from the Department of War's chief information officer - a policy decision, announced with a 60-day review attached and no contract language of its own. That is no longer an accurate description. The CMMC class deviation signed on 3 September has moved the pause into the acquisition rulebook contracting officers work from, and a pause that lives in the rulebook behaves very differently from one that lives in a press release.

Here is the direct answer. On 3 September 2026, John M. Tenaglia, principal director of Defense Pricing, Contracting, and Acquisition Policy, signed Revision 3 of class deviation 2026-O0025, which implements the Revolutionary FAR Overhaul's Part 40 and a rewritten DFARS Part 240. It directs contracting officers to work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts, following the CIO's 13 July memo: Level 1 (Self) and Level 2 (Self) assessments are permitted, baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012 is required, and the November 2026 Phase 2 transition is suspended. Third-party C3PAO assessment is no longer something a new DoD contract can be expected to demand.

One correction to the week's headlines is worth making, because it changes how you read what comes next. Revision 3 did not invent this direction. The deviation's own text says it carries the CMMC language forward from Revision 2, issued 16 July, three days after the suspension. September is when most of industry noticed; July is when the instrument first moved. The timeline below takes each step in order and annotates what it changed on paper.

The DFARS final rule, published 10 September 2025, took effect and made DFARS 252.204-7021 and the notice provision at 252.204-7025 live contract terms. Phase 1 opened with self-assessments; Phase 2, the year-two step that would have put C3PAO certification into solicitations, was scheduled for 10 November 2026.

What it legally changed: award eligibility. A contracting officer who inserted -7021 could not award to an offeror without a current CMMC status in SPRS at the required level. The program rule underneath, 32 CFR part 170, had been in force since December 2024 and defined the levels and statuses; the DFARS rule is what attached them to money.

The original 2026-O0025 deviation, signed in December 2025, took effect and told contracting officers to use the overhauled FAR Part 40 and a new DFARS Part 240 in place of the codified text. CMMC's prescription moved to DFARS 240.371. The assessment clause was renumbered as 252.240-7997, which preserves the government's authority to conduct Medium and High NIST SP 800-171 assessments and post their scores in SPRS, with 14 business days for a contractor to rebut. The old stand-alone -7019 notice does not appear in the deviation text; self-assessment results now reach SPRS through the CMMC clause's own reporting paragraphs.

What it legally changed: where the rules live and what they are numbered, for solicitations issued under the deviation. Contracts already signed kept the clauses they were signed with. This is the plumbing that later made the pause easy to deliver: once CMMC sat inside a deviation-controlled part, changing contracting-officer direction took a revision, not a rulemaking.

The CIO's memo, Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, stopped the November transition and stood up a CMMC Reform Task Force with 60 days to recommend changes.

What it legally changed: less than it seemed. A CIO memo directs the Department; it does not rewrite a solicitation or an awarded contract by itself. That gap is why our July pieces told readers to keep reading their paper, and it is the gap the deviation closed.

Revision 2 put the CIO's direction into 2026-O0025. Revision 3, whose other business is Alibaba's temporary relief under a court order, a Huawei-linked semiconductor ban, drone procurement limits, and a bar on selling DoD employee data, carries the CMMC paragraph forward intact.

What it legally changed: everything the memo could not reach. Program managers must initiate amendments to active solicitations, and contracting officers must issue them as soon as practicable. For existing contracts that carry the requirements, contracting officers must remove them by modification before the next option period is exercised or at the next scheduled administrative modification. The deviation remains in effect until rescinded or folded into the FAR, DFARS, and PGI.

That last sentence is why a class deviation is a harder thing to undo than a suspension. Reversing the July memo would have taken another memo. Reversing the deviation takes DPCAP issuing a new revision or a rescission, and then the unwinding of every amendment and modification made under it, one contract file at a time. Restoring a requirement to a performing contract is a new modification, and a contractor asked to accept one mid-performance is in a position to ask what it costs.

The same document that pulls third-party assessment out of contracts keeps the baseline in. DFARS 252.204-7012 is still prescribed for solicitations and contracts other than COTS-only buys, with its 72-hour incident report and the 110 requirements of NIST SP 800-171 Rev 2. The -7997 clause still lets DCMA assess you, and the clause says a DCMA result takes precedence over any other assessment on record, your own included. Clause -7021 is still in Part 240, and Level 1 (Self) and Level 2 (Self) still require a current score in SPRS and an annual affirmation by an affirming official, which is where self-attestation liability lives.

Two quieter points matter to anyone who already spent money. The deviation's list of valid statuses still includes Final Level 2 (C3PAO), good for up to three years with annual affirmation, so a certificate earned before the pause remains a status that satisfies a lower requirement; let the affirmation lapse and you forfeit that for nothing. And 32 CFR part 170, the program rule, is untouched: the deviation cites it and does not purport to amend it. Our CMMC overview and Level 2 page track that rule as written.

The task force's clock ran out around 11 September. Recommendations go first to CIO Kirsten Davies, who decides when and whether they are made public; trade coverage expects them between late September and early October. Davies has signaled her frame; DefenseScoop reported her saying on 9 September that "compliance doesn't equal security," and her team is reading more than 10,000 pages of industry responses.

Watch three documents rather than the briefings. A Revision 4 of 2026-O0025 is where any change in what contracting officers do would land first. A proposed rule touching 32 CFR part 170 is the only way the program itself, levels and assessment model included, gets rebuilt. And your own next option exercise or administrative modification is the moment the deviation reaches your contract, so read the modification before you sign it. If you want a second read on which version of the clause your awards actually carry, that is what a readiness conversation is for.

Whatever the task force recommends, it will arrive as a revision to an instrument that already lives in your contract file. The contractors who read that file line by line in October will know what changed. Everyone else will hear about it in a headline. ◆