The planned move to outside CMMC assessments is on hold, but firms that handle FCI or CUI still have real security work to do. Revision 3 of DFARS Class Deviation 2026-O0025 directs contracting officers to strip out or rework CMMC clauses so they match a July 13, 2026, memo from the DoW CIO that pauses Phase 2.
The pause targets third-party reviews. Self-assessments can still appear in bids, and the deviation leaves the NIST SP 800-171 Rev 2 baseline under DFARS clause 252.204-7012 fully in force. This guide covers what changed, what did not, and the steps that still apply.
Key facts
- The DFARS CMMC acquisition rule became effective on November 10, 2025.
- Phase 2 was meant to make Level 2 assessments by a C3PAO a condition of award.
- The class deviation says the CIO memo halts the Phase 2 shift planned for November 2026.
- Level 1 and Level 2 self-assessments may still be written into new procurement requests.
- Baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012 is still required.
- Cyber incidents still have to be reported to DoD no later than 72 hours after discovery.
Background
CMMC was never meant to arrive all at once. The DFARS rule lays out a phased rollout over three years. Once that period ends, the rule says CMMC covers every contract that involves FCI or CUI, apart from listed exceptions.
The phases are spelled out in federal regulations. Under the phase rules in 32 CFR 170.3, the second phase was due to start a calendar year after Phase 1. That step would have added outside Level 2 reviews by a C3PAO as something a firm had to have before it could win an award.
The class deviation changes that path for now. The deviation puts it plainly: the CIO memo "Suspends the November 2026 CMMC Phase 2 transition." The current text is Revision 3, which replaces Revision 2, issued on July 16, 2026.
One gap is worth noting. The regulation itself has not caught up. The current eCFR text still says Phase 2 starts one year after Phase 1. It is not known if part 170 of 32 CFR will get a formal amendment.
What it means for you
The biggest change is narrow. For now, a firm should not expect a new solicitation to demand a third-party Level 2 review as a condition of award. That is the piece the deviation puts on hold.
Most other duties stay. During the suspension, the offices that request work may still ask for a self-assessment at Level 1 or at Level 2. So a firm that planned to wait for a C3PAO may still need its own scored review in the near term.
The core security baseline also holds. The deviation keeps NIST SP 800-171 Rev 2 compliance required under DFARS clause 252.204-7012. In plain terms, the controls that protect CUI are still expected, whether or not an outside assessor checks them.
Contracts already in hand may change too. If a current contract carries the paused terms, contracting officers must take them out through a contract modification, either ahead of the coming option period or during the next routine administrative update. Firms can watch for those changes rather than assume the old terms still bind them.
Subcontractors face the same picture through their primes. A short guide on what your prime will ask for explains how these duties flow down the supply chain.
Practical steps
The pause does not erase the self-assessment rules. These steps come straight from the regulations and the deviation.
- Keep Level 1 current. A Level 1 self-assessment has to be redone each year, with results entered in SPRS. Plans of action and milestones (POA&Ms) are not permitted at this level, so every requirement must be met.
- Plan the Level 2 cycle. A Level 2 self-assessment is redone every three years. An affirmation is due with each assessment and then once a year after that.
- Know your score. Level 2 results posted in SPRS carry an overall score, and the rule uses "105 out of 110" as its example.
- Close open items fast. When a firm holds Conditional Level 2 (Self) status, its open POA&M items have to be resolved within 180 days. If they are not, the status lapses.
- Keep the evidence. Assessment records must be retained for six years, counted from the CMMC Status Date.
- Be ready to report incidents. DFARS 252.204-7012 requires a report to DoD through dibnet.dod.mil within 72 hours of finding a cyber incident. Images of affected systems must be kept for at least 90 days.
Good records make each of these steps easier. A simple IT documentation checklist can help a team track systems, owners and changes in one place.
Help is available for the technical side. Our cybersecurity services can support control reviews, logging and incident response planning. Our public sector IT support can help keep systems patched and documented between assessments.
What happens next
Several key questions remain open. The deviation gives no new start date for Phase 2, and it is not known when, or whether, the C3PAO step will return.
The text of the CIO memo is also not cited here, because the source pages for it could not be opened. Readers should rely on the deviation for what the memo does.
In the meantime, expect existing contracts to be updated at option periods or routine administrative changes, as the deviation directs. Firms that keep their self-assessments, scores and evidence current will be in a stronger spot if outside reviews resume.