By Austin Justice, Vice President, Justice IT Consulting | Last updated: October 2026

A DoD class deviation is an instruction to contracting officers, not to contractors. It authorizes them to depart from the written regulation. On September 3, 2026, the Department of War (DoW, formerly the Department of Defense) issued Revision 3 of DARS Class Deviation 2026-O0025, which turns the July 13 CMMC Phase 2 suspension into binding contracting instructions. It removes third-party (C3PAO) certification requirements from solicitations and contracts, but it does not remove the cybersecurity requirements underneath them.

For defense manufacturers in Dallas-Fort Worth, the practical question is what this means for the contracts already on your desk. The short answer from Justice IT Consulting's CMMC team: it changes less than most people assume.

What a Class Deviation Actually Is

A policy announcement says what the department wants to happen. A class deviation is the document that lets contracting officers actually do it, because without one they would be bound by the regulatory text as written. Because it speaks to contracting officers, you won't find it as a clause in your contract. You'll see its effect when a solicitation is amended or a contract is modified.

What Revision 3 Does

According to analyses from Elevate Consulting and Kiteworks, Revision 3:

  • Directs contracting officers to remove or revise CMMC requirements in new and existing solicitations and contracts, in line with the July 13 CIO memorandum
  • Permits CMMC Level 1 (Self) and Level 2 (Self) assessments in procurement documents, and tells contracting officers to amend active solicitations accordingly
  • Keeps baseline compliance with NIST SP 800-171 Revision 2 required under DFARS 252.204-7012
  • Writes the Phase 2 suspension into the DFARS Part 240 text. Phase 2 had been scheduled to begin November 10, 2026

It supersedes Revision 2, issued July 16, and it's already the third version in under two months. That pace is a reminder to confirm you're reading the current one, which the DoW posts on its DFARS and FAR overhaul class deviations page.

What It Does Not Change

Here is what the deviation changed, what it left in place, and why that matters:

Changed by the deviation Not changed Why it matters to you
C3PAO and DIBCAC assessment levels removed from solicitations The underlying NIST SP 800-171 security requirement You still have to implement the controls
Self-assessment accepted as the verification method SPRS score posting and annual affirmation Your own claim is now what the government relies on
Contracting officers told to amend documents The government's own authority to conduct Medium and High assessments A government assessment can still test your score
Phase 2 start date suspended The CMMC program rule itself, which was not repealed The program is paused, not cancelled

Kiteworks' analysis of Revision 3 notes that the government can still conduct Medium and High NIST SP 800-171 assessments of any covered contractor, that a summary score from those assessments is posted to SPRS where DoW components can see it, and that contracting officers must check SPRS before award, before exercising an option, and before extending a period of performance.

What This Means for Contracts You Already Hold

A government-wide contracting instruction does not substitute for reading your actual award. Review the applicable solicitation or contract language, any amendments or modifications, and written contracting-officer direction. Do not presume that an existing clause has vanished, or that every third-party assessment obligation has the same effective date. If requirements conflict or the effect of a deviation is unclear, request clarification from your contracting officer and qualified government-contracts counsel. Separate federal contract terms from a prime contractor's independent supplier terms.

Don't Be Thrown by Renumbered Clauses

Revision 3 sits inside the DoW's broader federal acquisition overhaul, which has renumbered several familiar DFARS clauses. For example, the NIST SP 800-171 DoD assessment clause you know as 252.204-7020 was renumbered as 252.240-7997 under the DFARS overhaul deviations, and it now covers only Medium and High assessments, according to Secureframe. If your contract references an unfamiliar number, check whether it's a renumbered version of a clause you already know.

How Long Does the Pause Last?

The suspension and its implementing deviations may change again. As of this draft's October 2026 review date, businesses should check the current official class-deviation text and their particular solicitation rather than relying on predictions about 2028 or a future revision. Continue required safeguarding, self-assessments, and remediation; make certification spending decisions based on actual contract terms and customer requirements.

What to Do Now

Related Justice IT resources: Subcontractor CMMC basics | Prime contractor requirements after the pause | Should you certify during the pause?

  • Check your solicitations and contracts for actual modifications, and ask your contracting officer to confirm in writing if you're unsure
  • Confirm your SPRS score is current and honestly reflects your implementation, because it now carries more weight (see how POA&Ms affect your SPRS score)
  • Keep your SSP and POA&M current. Self-assessment lowers the bar for entry, not the bar for exposure
  • Ask your primes separately what they require, since the deviation doesn't bind them
  • Plan as if a deadline will return. Our breakdown of what happens if you miss a CMMC deadline explains the cost of waiting

Frequently Asked Questions

What is a class deviation in DoD contracting?

A class deviation is a formal authorization that lets DoD (now DoW) contracting officers depart from the written FAR or DFARS text for a category of contracts. It's directed at contracting officers, not contractors, so you see its effect through solicitation amendments and contract modifications rather than a new clause.


What is Class Deviation 2026-O0025 Revision 3?

Revision 3, issued September 3, 2026, is the DoW instruction that writes the CMMC Phase 2 suspension into DFARS Part 240 contract text. It permits Level 1 (Self) and Level 2 (Self) assessments, directs contracting officers to remove or revise CMMC requirements, and keeps NIST SP 800-171 Rev. 2 compliance required under DFARS 252.204-7012.


Does the class deviation remove CMMC from my existing contract?

Not automatically. The deviation directs contracting officers to revise existing contracts, which happens through a contract modification. Until you see a modification or written confirmation from your contracting officer, assume the CMMC clause in your current contract still applies.


Do I still need an SPRS score under the class deviation?

Yes. Self-assessment is now the accepted verification method, so your SPRS score and annual affirmation carry more weight, not less. Contracting officers must check SPRS before award, before exercising an option, and before extending a period of performance.


Does the class deviation change my prime contractor's requirements?

No. The deviation governs federal contract language between the DoW and its contractors. Your prime's subcontract terms and supplier requirements are separate, so a prime can still require CMMC Level 2 certification from you. Ask your prime in writing.

How Justice IT Helps Contractors Interpret the Technical Impact

  • Justice IT Consulting helps DFW defense contractors review the technical effects of their cybersecurity requirements, including environment scoping, implementation evidence, and remediation planning. Contract interpretation and legal advice remain with the contracting officer and qualified counsel.

Not sure whether your contract has actually been modified, or what your self-assessment now has to show? Book a plain-English review with Justice IT Consulting.

About the Author

Austin Justice is Vice President of Justice IT Consulting, a CMMC Level 2 certified Registered Practitioner Organization in Burleson, Texas, and the Amazon best-selling author of The Compliance Formula: The Definitive Guide to Understanding and Implementing CMMC. He started freelancing in IT in high school, where he earned five IT certifications before graduating, competed nationally in Cisco Networking, and became one of only six youth in the nation certified as a Panduit fiber and copper technician. Since then he has pulled cable, worked the help desk, designed network infrastructure, and consulted with companies during and after cyber breaches. His certifications span Cisco, SonicWALL, networking, hardware, and fiber and copper technologies. Off the clock, Austin and his family raise Santa Gertrudis cattle.

Sources / Further Reading