The CMMC Pause Is Now in Writing: What Class Deviation Revision 3 Changes, and What It Doesn’t

By Josh Hammer

Published September 21, 2026

The Department of War’s Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, gives contractors a clearer answer to an important question:

What happens to CMMC while the Department reviews the program?

The answer requires precision. CMMC Phase II third-party assessments are paused. The CMMC program itself remains in place. The pause affects the third-party verification mechanism, not the underlying cybersecurity obligations that already apply through contracts, DFARS clauses, NIST requirements, self-assessments, SPRS reporting, and incident-response duties.

Revision 3 matters because it moves that direction out of informal administrative policy and into enforceable acquisition instructions. Contracting officers are directed to remove or revise third-party assessment requirements in active solicitations and existing contracts.

That is significant. It is also narrower than many headlines suggest.

In this article, I will explain:

• What a class deviation is and why Revision 3 matters.
• What changed for Phase II third-party assessments.
• What remains mandatory for contractors.
• How the new supply-chain and data restrictions operate independently of CMMC.
• Why NIST SP 800-171 Revision 2 remains the contractual baseline.
• What the CMMC Reform Task Force may do next.
• How to audit your current state before selecting compliance tools.

Bottom line: The class deviation removes a verification requirement. It does not remove a control requirement.

What is a class deviation?

A class deviation is an acquisition instruction that allows an agency to depart from existing Federal Acquisition Regulation or Defense Federal Acquisition Regulation Supplement language for a defined period or purpose.

It is not the same thing as a permanent regulation. But it is more operationally consequential than an internal memo because it directs contracting officers how to write, modify, and administer solicitations and contracts.

That distinction is central to Revision 3.

The September 3 analysis from Inside Government Contracts reports that the Department of War issued Revision 3 to implement revised DFARS Part 240 and related procedures. The official deviation memorandum directs contracting officers to remove or revise affected CMMC requirements from new and existing solicitations and contracts.

The acquisition workforce is not merely being told to “wait and see.” It is being told how to act.

For active solicitations, that means issuing amendments where necessary. For existing contracts, it generally means modifying the contract before the next option exercise or scheduled administrative modification.

The practical consequence is that contractors should review the contract file, not just news coverage, to determine whether a C3PAO requirement has actually been removed or revised.

What Revision 3 changes

1. Phase II third-party assessments are paused

Revision 3 carries forward the Department’s July 13 policy suspending the transition to CMMC Phase II. That transition would have required third-party assessments for many Level 2 contractors handling CUI.

Under the revised direction, contracting officers are instructed to remove or revise third-party assessment requirements from:

• New solicitations.
• Active solicitations.
• Existing contracts containing affected CMMC language.

The MeriTalk report on the September 3 acquisition memo describes the change as a move from a temporary administrative pause to a binding acquisition instruction.

This does not mean that a contractor may stop protecting CUI. It means that, for the period covered by the deviation, the Department is not requiring the same third-party verification mechanism in the affected contracts.

2. Self-assessment remains available and relevant

Revision 3 allows requiring activities to include CMMC Level 1 (Self) or Level 2 (Self) assessments when appropriate.

That distinction matters:

• Self-assessment: Your organization evaluates its own implementation, records the result, and submits or maintains the information required by the applicable contract and SPRS process.
• Third-party assessment: An authorized external assessment organization evaluates the applicable environment under the CMMC assessment process.

The pause applies to the second category. It does not eliminate the first.

A self-assessment is not a ceremonial form. It is a representation about the condition of your environment. It should be supported by an accurate scope, documented policies and procedures, implemented controls, and objective evidence.

A contractor that cannot explain how its score was calculated, or what evidence supports it, has a process problem regardless of whether a third-party assessment is currently required.

3. Universal CMMC requirements are deferred to November 10, 2028

The universal CMMC mandate is deferred to November 10, 2028. Until then, program offices may insert CMMC clauses on a case-by-case basis.

This is not a blanket exemption. A program office may still determine that a solicitation or contract requires a specific CMMC level or self-assessment approach.

The current deviation summary at Part52.dev identifies the case-by-case reality and explains the contracting officer actions associated with the deviation. The GovConIC analysis likewise emphasizes that the delay changes the rollout schedule without eliminating contract-specific requirements.

So, what should you read?

Read the solicitation. Read the contract. Read the flow-down language from your prime contractor. Do not rely on the calendar alone.

What Revision 3 does not change

The most important obligations remain.

DFARS 252.204-7012 remains in force

For contracts that include it, DFARS 252.204-7012 continues to require contractors to safeguard covered defense information and report qualifying cyber incidents.

The clause remains a foundational obligation even while Phase II third-party assessments are paused.

NIST SP 800-171 Revision 2 remains the contractual baseline

NIST has published SP 800-171 Revision 3. That publication matters for planning, architecture, and future regulatory developments.

But Revision 3 of the class deviation does not automatically make NIST SP 800-171 Revision 3 the current DoD contractual baseline.

For applicable contracts, NIST SP 800-171 Revision 2 remains the required baseline under DFARS 252.204-7012.

Do not prematurely renumber your control set, rewrite your System Security Plan, or claim alignment to a new baseline merely because the newer NIST publication exists. First confirm what your contract requires and whether the Department has formally transitioned the applicable clause.

Inside Cybersecurity has reported that the Pentagon is preparing an interim final rule to adopt the latest NIST standards for CUI. That is an important development, but it is not the same as a completed contractual transition. Contractors should track the reported interim final rule activity without treating a proposed or pending change as today’s contract requirement.

Level 1 obligations continue

CMMC Level 1 requires an annual self-assessment against the 15 requirements in FAR 52.204-21, followed by an executive affirmation in SPRS.

Level 1 is not a certification. It does not require a C3PAO. It does not permit POA&Ms.

Every applicable requirement must be implemented before the organization submits a final Level 1 result. An executive affirmation should therefore be based on a meaningful review, not an assumption that a policy document or software report equals implementation.

Level 2 self-assessment and SPRS obligations continue

For applicable contracts, Level 2 self-assessment obligations and SPRS scoring requirements continue.

That includes:

• Maintaining an accurate NIST SP 800-171 assessment score.
• Maintaining the scope associated with the assessment.
• Updating information when required.
• Completing annual affirmations.
• Retaining evidence supporting the assessment.
• Preparing for possible government-led assessment activity where contract language permits or requires it.

The H&V CMMC FAQ page provides a plain-language overview of CMMC levels, assessment expectations, scope, and the role of readiness planning.

The 72-hour incident-reporting duty remains unchanged

DFARS 252.204-7012’s 72-hour cyber incident reporting requirement remains in force when the clause applies.

A pause in third-party assessment scheduling does not extend the reporting deadline. Contractors must maintain an incident-response process capable of identifying, analyzing, containing, documenting, and reporting covered incidents within the required period.

Three new restrictions that operate independently of CMMC

Revision 3 also addresses supply-chain and information-security restrictions that should be analyzed separately from the CMMC assessment pause.

Huawei-related semiconductor restrictions

Contractors are restricted from supplying covered semiconductors, semiconductor manufacturing equipment, or semiconductor design tools to Huawei and its subsidiaries or affiliates under the applicable statutory framework.

The Inside Government Contracts summary explains that the restriction implements FY2025 NDAA Section 853.

This is a supply-chain and contracting restriction. It is not a CMMC control that disappears because third-party assessments are paused.

Unmanned aircraft system restrictions

Revision 3 also implements restrictions involving certain unmanned aircraft systems and related components from China, Russia, Iran, or North Korea.

The restriction reaches beyond whether a contractor has a CMMC self-assessment. Procurement teams should review:

• Drone hardware.
• Counter-drone systems.
• Detection and identification equipment.
• Components and software.
• Suppliers and subcontractors.
• Equipment used in contract performance.

The GovConFeed analysis of the Huawei and drone restrictions provides additional context.

Covered Department of War employee data

Contractors are also restricted from selling, licensing, or otherwise transferring covered personally identifiable information relating to Department of War employees to non-government parties, subject to the exceptions described in the applicable clause.

This obligation may flow down to subcontractors and other contractual instruments. It should be handled as a data-governance and subcontract-management issue, not merely as a CMMC documentation task.

Ask:

• What covered employee data do we receive?
• Where is it stored?
• Which vendors can access it?
• Is it transferred outside the government?
• What contractual restrictions apply to our subcontractors?
• Are the required clauses included in downstream agreements?

The compliance tools versus compliance process problem

The CMMC assessment pause creates a temptation to delay everything. The opposite mistake is also common: purchasing a compliance platform before understanding the environment.

I have written previously about why compliance tools are not a compliance program. The principle is straightforward:

Audit first. Build a plan second. Select tools third.

A compliance tool can help you map controls, request evidence, monitor configurations, assign remediation tasks, and report progress. It cannot decide:

• Whether CUI is present.
• Which systems are in scope.
• Whether a control is actually operating.
• Whether evidence is complete and reliable.
• Whether an exception is acceptable.
• Whether an executive affirmation is accurate.

Before selecting a solution, conduct a current-state audit.

Document:

1. The contracts and clauses that apply.
2. The FCI and CUI your organization handles.
3. The systems, facilities, users, vendors, and subcontractors in scope.
4. The controls currently implemented.
5. The evidence supporting each control.
6. The gaps that create the greatest contractual or operational risk.
7. The owners, deadlines, dependencies, and resources for remediation.

Only then should you determine whether automation, consulting, managed services, or a hybrid model best fits the work.

What the CMMC Reform Task Force could do next

The CMMC Reform Task Force’s 60-day review closed on September 11, 2026. Recommendations have been delivered to DoW CIO Kirsten Davies, but they have not been publicly released. Observers expect public direction in late September or early October.

The DefenseScoop report on the review describes more than 1,100 industry responses and more than 10,000 pages of written feedback, along with listening sessions attended by more than 3,000 people.

From a planning perspective, contractors should prepare for four possible outcomes:

1. A delayed resumption of broad third-party assessments. The Department could preserve the existing structure while moving the implementation date.

2. A narrower third-party assessment requirement. Third-party assessments could be limited to certain data types, programs, contract values, or mission areas.

3. A larger role for self-assessment and executive affirmation. The Department could retain self-assessment for more contractors while strengthening evidence, reporting, and oversight requirements.

4. A deeper restructuring around continuous monitoring and operational technology. DoW officials have raised concerns that a point-in-time assessment does not adequately address manufacturing lines, facility systems, and operational technology. Future requirements may place greater emphasis on continuous visibility and resilience.

Do not build your entire compliance strategy around one forecast. Build a control environment that can adapt to each scenario.

Where H&V Complynt fits

H&V Complynt supports organizations that need to manage complex, overlapping obligations across cybersecurity, privacy, quality, and operational environments.

The platform provides:

• Automated control mapping.
• Evidence collection and organization.
• Continuous compliance monitoring.
• Pre-built content packs.
• Policy-as-code capabilities.
• Remediation tracking.
• Cross-framework visibility across more than 150 standards, including CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, and ISO 27001.

Complynt runs on FedRAMP High and DoD IL5 authorized infrastructure on Palantir’s federal cloud. H&V is also EDWOSB certified.

Our model combines automation with human expertise. That matters for federal contractors, construction firms, and facility operators whose environments may include cloud systems, engineering workstations, building automation, industrial control systems, subcontractor portals, and other specialized assets.

H&V does not issue CMMC certification and cannot guarantee an assessment outcome. The purpose of our work is to help you understand the applicable requirements, define scope, build a defensible remediation plan, maintain evidence, and operate a stronger compliance process.

The pause gives contractors time. It does not remove responsibility.

Start by auditing your environment. Build a plan that reflects your actual contracts and systems. Then use technology to make the process more consistent, visible, and sustainable.

Read next in this series

• CMMC FAQs: Levels, scope, self-assessment, and readiness planning
• Why compliance tools are not a compliance program
• Start the free H&V compliance readiness check
• Explore H&V’s compliance automation services

Our step-by-step Technical Guide series also covers CMMC Level 1, SPRS access, CUI scoping, evidence collection, and related implementation tasks.

Frequently asked questions

Does Revision 3 mean CMMC has been canceled?

No. CMMC Phase II third-party assessments are paused. Revision 3 does not repeal the CMMC program, remove underlying cybersecurity obligations, or prevent program offices from inserting CMMC requirements case by case.

Do contractors still need to comply with DFARS 252.204-7012?

Yes, when the clause applies to the contract. DFARS 252.204-7012 continues to require safeguarding covered defense information, compliance with the applicable NIST SP 800-171 baseline, and 72-hour cyber incident reporting.

Is NIST SP 800-171 Revision 3 now mandatory for DoD contractors?

Not automatically. NIST SP 800-171 Revision 2 remains the contractual DoD baseline under DFARS 252.204-7012 unless and until the applicable contract language or final regulatory action changes it.

Is CMMC Level 1 a certification?

No. Level 1 requires an annual self-assessment against the 15 FAR 52.204-21 requirements and an executive affirmation in SPRS. It is not a certification, and Level 1 does not permit POA&Ms.

Do Level 2 self-assessment and SPRS requirements continue?

Yes, for applicable contracts. Contractors must maintain accurate assessment information, SPRS scoring, annual affirmations, and supporting evidence.

Can I wait to conduct an audit until the Department releases the Task Force recommendations?

You can wait, but doing so creates unnecessary risk. Contractual obligations remain active, remediation can take months, and future requirements may be easier to manage if your scope, evidence, and control ownership are already documented.

Can a compliance platform make my organization compliant?

No. A platform can support control mapping, evidence collection, monitoring, and remediation management. It cannot replace the compliance process, responsible control owners, leadership decisions, or an independent assessment where one is required.

What should I do first?

Audit your current state. Confirm which contracts and clauses apply, define your FCI and CUI scope, assess the controls you actually operate, and build a prioritized remediation plan. Then select the tools that support that plan.

Start with a free readiness check

Do not guess where you stand. Use H&V’s free compliance readiness check to receive a directional score, domain-level gap information, and a prioritized starting point.

The check is for planning purposes only. It is not an official assessment or certification, and H&V does not guarantee any assessment outcome.