FAR Part 40 is where the CMMC Phase 2 suspension stopped being a policy statement and became a binding term in actual defense contracts. On September 3, 2026, the Office of the Assistant Secretary of War issued DARS Tracking Number 2026-O0025, Revision 3, a class deviation implementing the Revolutionary FAR Overhaul’s Part 40, Information Security and Supply Chain Security, along with the corresponding DFARS Part 240. Buried inside this deviation, alongside several unrelated supply chain security provisions, is the specific instruction that turns the Department of War CIO’s July suspension memo into something contracting officers are now required to act on in your actual solicitations and contracts.
This article explains what this class deviation actually requires contracting officers to do, what it confirms remains unchanged, and what a defense contractor should expect to see happen to its own contracts as a direct result.
What DARS 2026-O0025, Revision 3 Actually Is
A class deviation is not a policy announcement. It is a formal instruction that authorizes and directs contracting officers to depart from the codified FAR or DFARS text and use different, specified language instead, effective immediately upon issuance. This particular deviation revises and supersedes its own prior version, Revision 2, which had been issued on July 16, 2026, meaning this is already the third iteration of this specific instrument in under two months.
The Regulatory Chain From CIO Memo to Binding Deviation
The Department of War Chief Information Officer’s memorandum suspending the advancement to CMMC Phase 2, dated July 13, 2026, announced the policy: program managers could require only CMMC Level 1 (Self) or Level 2 (Self) assessments, the Phase 2 third-party assessment transition was suspended, and baseline compliance with NIST SP 800-171 Revision 2 remained required. That memo, on its own, directed program managers and requiring activities. This class deviation is the document that formally authorizes contracting officers to depart from the codified regulatory text to actually implement that direction inside solicitations and contracts. The original suspension explained covers what the policy itself changed; this deviation is the mechanism that makes it enforceable contract language rather than internal guidance.
Why This Is Already on Its Third Revision
A class deviation reaching its third revision in under two months signals that the underlying policy area is still actively being refined, not that anything about the suspension itself is in doubt. This revision specifically implements several statutory requirements and corrects definitions, including fixes to the definitions of covered lobbyist and Chinese military company used elsewhere in the same Part 40 text. Contractors should treat a class deviation with an active revision history as a live document to monitor, not a one-time notice to file away, since a fourth revision addressing further corrections or statutory updates is a reasonable expectation given this pace.
Reading a Class Deviation Correctly
A class deviation is directive to contracting officers, not directly to contractors, which is a distinction worth understanding before drawing conclusions from one. It tells a contracting officer to use specific revised text in place of the codified FAR or DFARS provisions; it does not itself amend a contractor’s existing contract. The actual change to a contractor’s situation happens when a contracting officer acts on the deviation, through a solicitation amendment or a contract modification, which is why the timing questions addressed below matter as much as the deviation’s existence itself. Reading a class deviation and assuming it immediately and automatically changes every affected contract’s terms is a common and understandable misreading of how this instrument actually works.
What Contracting Officers Are Now Required to Do
The operational core of this deviation, for CMMC purposes, is a specific set of instructions directing contracting officers to take concrete action on solicitations and contracts already in progress.
Amending Active Solicitations
Contracting officers must collaborate with requiring activities to remove or revise CMMC requirements in new and existing solicitations in accordance with the CIO’s suspension memo. Program managers and requiring activities are required to initiate the amendments, provide them to the cognizant contracting officer, and contracting officers must then issue the corresponding solicitation amendments as soon as practicable. A contractor with a proposal currently in evaluation against a solicitation that still references Phase 2 CMMC requirements should expect an amendment removing or revising that language, rather than assuming the original solicitation text controls simply because it predates this deviation.
Modifying Existing Contracts
For contracts already awarded that contain Phase 2 CMMC requirements, this deviation requires contracting officers to remove them through a modification, either prior to the exercise of the next option period or through the next scheduled administrative modification, whichever comes first in the contract’s normal cycle. This means a contractor should not expect an immediate, out-of-cycle modification to every affected contract. The removal is tied to the contract’s existing administrative rhythm, which means the timing varies considerably depending on where a given contract sits in its option period or modification schedule.
| Contract situation | What triggers the modification | Realistic timing |
|---|---|---|
| Contract nearing an option period exercise | The option period exercise itself | Weeks to a few months |
| Contract with a scheduled administrative modification already planned | That scheduled modification | Depends on the existing schedule |
| Contract with neither event imminent | Whichever event happens first | Potentially well over a year |
| New solicitation not yet awarded | Direct amendment, not a modification | As soon as practicable per the deviation |
The pattern in this table matters for planning: a contractor should not expect uniform timing across a portfolio of contracts, and a contract with no option period or administrative modification on the near-term horizon may carry Phase 2 language in its official file for a considerable period even though the requirement is not being enforced. This administrative lag is normal under the deviation’s own terms and is not evidence that the suspension is not actually in effect.
The Baseline That Does Not Move
Consistent with the underlying CIO memo, this deviation reaffirms that baseline compliance with NIST SP 800-171 Revision 2 remains required through the clause at DFARS 252.204-7012, and that CMMC Level 1 (Self) and Level 2 (Self) assessments remain permitted in procurement requests. Nothing in this class deviation touches DFARS 7012 compliance itself, and the broader DFARS compliance checklist covering 252.204-7012, -7019, -7020, and -7021 together remains the accurate picture of what stays in force. This deviation is specifically about how the CMMC Phase 2 third-party assessment language gets removed from contract documents, not a change to the underlying self-assessment and safeguarding obligations.
What This Means for Your Specific Contracts
The practical impact of this deviation depends heavily on where a contractor sits relative to the solicitation and award process right now.
If You Are Currently Bidding
A contractor responding to an active solicitation that still contains Phase 2 CMMC language should expect that language to be amended out under this deviation’s direction, and should watch for the formal amendment rather than assuming the original solicitation text no longer applies simply because policy has changed. Submitting a proposal against outdated solicitation language, without confirming whether an amendment has been issued, risks a proposal that responds to requirements the government itself is actively removing.
If You Hold an Existing Contract
A contractor with an active contract containing Phase 2 CMMC requirements should not expect an immediate modification. The deviation ties removal to the contract’s next option period exercise or its next scheduled administrative modification, so the practical timing could range from weeks to well over a year depending on the specific contract’s cycle. In the meantime, the underlying NIST SP 800-171 Rev 2 and DFARS 7012 obligations remain exactly what they were, which means there is no operational reason to relax compliance work while waiting for the contract paperwork to catch up with the policy. The full NIST 800-171 compliance picture is unaffected by any of this deviation’s provisions and remains the standard to maintain regardless of when a given contract’s own paperwork is updated.
Do Not Wait for the Modification to Confirm Your Status
A contractor holding a contract that still contains unremoved Phase 2 language, simply because its option period has not yet come up, should not read that unmodified contract language as evidence the suspension does not apply to it. The suspension’s substantive effect, that third-party Phase 2 assessment is not currently required, applies based on the CIO memo and this deviation’s underlying policy, independent of whether a specific contract’s paperwork has caught up yet. Contractors uncertain whether a specific contract’s current language still reflects the old requirement should confirm directly with their contracting officer rather than assume either outcome from the contract text alone.
The Other Provisions in This Deviation
This class deviation covers considerably more than CMMC. It also implements a narrow, court-ordered temporary waiver related to a specific pending legal matter involving a named entity’s status under a restricted-source designation, and it carries forward the broader Part 40 and DFARS Part 240 framework governing prohibited telecommunications and video surveillance equipment sourced from restricted foreign entities, largely reorganizing existing statutory prohibitions rather than introducing new ones. These provisions sit in the same document but address a different set of concerns than the CMMC-related instructions above, and a contractor whose primary exposure is CMMC and DFARS cybersecurity clauses does not need to treat the broader supply chain security provisions as directly actionable unless its specific contracts involve covered telecommunications equipment or services.
Why One Document Covers Both
A class deviation of this kind exists to keep an entire regulatory part current in one authoritative instrument, rather than issuing separate deviations for every distinct policy change that touches the same part of the FAR or DFARS. Part 40’s scope covers information security and supply chain security broadly, which is why a CMMC-related suspension and an unrelated telecommunications procurement restriction can both live inside the same class deviation without being substantively connected. A contractor reviewing this document for the first time should expect this breadth and read past the sections that do not apply to its own contracts rather than assume the entire document is CMMC-focused because that happens to be the section most relevant to a compliance advisory audience.
Elevate helps defense contractors track how policy announcements like the CMMC Phase 2 suspension actually translate into binding contract language, and confirms what a specific solicitation or contract requires as class deviations and amendments move through the acquisition system. To review how this deviation affects your active solicitations or existing contracts, book a readiness call with an Elevate advisor.
Conclusion
FAR Part 40 and this class deviation are where the CMMC Phase 2 suspension became something contracting officers are formally directed to act on, not just a policy contractors could choose to interpret loosely. Active solicitations are being amended, existing contracts will be modified on their normal administrative cycle, and none of this touches the underlying NIST SP 800-171 Rev 2 and DFARS 252.204-7012 obligations that remain fully in force. A contractor tracking this correctly watches for the actual amendment or modification on its own contracts rather than assuming the policy announcement alone changed anything binding.
Given this deviation has already reached its third revision in under two months, staying current on further changes is worth building into a standing compliance review rather than treating this as settled. Book a readiness call to confirm what this deviation means for your specific contracts.
Key Takeaways
- DARS 2026-O0025, Revision 3 is the formal mechanism implementing the CMMC Phase 2 suspension in actual contracts. It authorizes contracting officers to depart from codified FAR and DFARS text, which is different from and more binding than the CIO memo alone.
- Active solicitations are being amended, and existing contracts will be modified on their normal cycle. Contract modifications happen prior to the next option period exercise or the next scheduled administrative modification, not immediately or uniformly.
- DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain untouched. This deviation is specifically about removing Phase 2 CMMC third-party assessment language, not about the underlying safeguarding and self-assessment obligations.
- This is already the third revision of this specific class deviation. Contractors should treat it as a live, evolving instrument worth monitoring rather than a one-time notice.
- The deviation covers unrelated supply chain security provisions alongside CMMC. A narrow court-ordered waiver and broader restricted-telecommunications-equipment prohibitions sit in the same document but require separate attention only if directly applicable to a contractor’s specific business.
FAQs
What is DARS Tracking Number 2026-O0025? DARS Tracking Number 2026-O0025 is a class deviation issued by the Office of the Assistant Secretary of War implementing the Revolutionary FAR Overhaul’s Part 40, Information Security and Supply Chain Security, along with the corresponding DFARS Part 240. Revision 3, issued September 3, 2026, directs contracting officers to remove or revise CMMC Phase 2 requirements from solicitations and contracts in accordance with the Department of War CIO’s July 2026 suspension memorandum, among other provisions.
How does this class deviation affect existing defense contracts with CMMC requirements? For contracts already awarded that contain Phase 2 CMMC requirements, the deviation requires contracting officers to remove those requirements through a modification, either before the next option period is exercised or through the next scheduled administrative modification, whichever occurs first. This means the timing of a modification depends on where a specific contract sits in its own cycle, not on a single uniform date.
Does this deviation change DFARS 252.204-7012 or NIST 800-171 requirements? No. This class deviation reaffirms that baseline compliance with NIST SP 800-171 Revision 2 remains required under DFARS 252.204-7012, and that CMMC Level 1 and Level 2 self-assessments remain permitted in procurement requests. It specifically addresses removing Phase 2 third-party CMMC assessment language from contract documents and does not alter the underlying safeguarding, reporting, or self-assessment obligations.
Why is this class deviation already on its third revision? Revision 3 implements several statutory requirements and corrects definitions used elsewhere in the Part 40 and DFARS Part 240 text, including fixes to terms used in unrelated supply chain security provisions within the same document. A class deviation reaching multiple revisions within a short period reflects ongoing refinement of a broader regulatory area rather than any change in the underlying CMMC suspension policy itself.
What should a contractor do if their active solicitation still references Phase 2 CMMC requirements? A contractor should expect that solicitation language to be amended under this deviation’s direction rather than assume it no longer applies simply because policy has changed. Watching for the formal solicitation amendment, and confirming its terms before finalizing a proposal, is the reliable way to avoid responding to requirements the government is actively in the process of removing.