The Department of War’s September 3, 2026 Revision 3 of Class Deviation 2026-O0025 gives contracting officers a specific schedule for inserting the CMMC clause at DFARS 252.204-7021. Section 240.371-5 says that, until November 9, 2028, the clause is used when the program office or requiring activity determines a contractor needs a specific CMMC level, subject to the stated exception in 32 CFR 170.5(d) and the COTS exclusion. On or after November 10, 2028, the prescription changes to contracts that require contractor information systems to process, store, or transmit FCI or CUI. The accompanying 252.204-7025 provision goes into solicitations that include 7021.
That clause schedule should be read alongside, not substituted for, the July 13, 2026 Phase II suspension announcement. The Department said Phase II requirements were suspended and Phase I self-assessment requirements remained in place. A program announcement is not a substitute for reading a live solicitation, amendment, clause prescription, system scope, and SPRS record. This guide walks through the current deviation text and gives a safe way for proposal and security teams to resolve the mismatch between older calendars and current procurement language.
Use the September 2026 deviation text as your working map
DFARS Part 240 is currently being used under a class deviation rather than only through the older codified structure that many checklists still quote. The DARS page lists Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, and links the revised Part 240 attachment. Section 240.371 covers CMMC. For a current DoW solicitation, capture the revision date and read the clause prescription in 240.371-5 together with the actual clauses and amendments attached to the procurement. A search result or a saved 2025 template is not enough to establish what the contracting officer included.
This distinction matters because older sources may still show DFARS 204.7504 as the prescription, while Revision 3 uses 240.371-5 in the deviation text. The two versions express a similar staged idea, but the controlling text for a given solicitation depends on the deviation and acquisition documents applicable to that procurement. If the solicitation appears to use a clause set inconsistent with the current direction, do not silently rewrite it in your proposal tracker. Ask the contracting officer to clarify and retain the response with the solicitation version reviewed.
Read the two time periods in 240.371-5 carefully
Until November 9, 2028, paragraph (a)(1) directs use of 252.204-7021 if the program office or requiring activity determines that the contractor must have a specific CMMC level. On or after November 10, 2028, paragraph (a)(2) describes insertion when the office determines that contractor information systems will process, store, or transmit FCI or CUI during contract performance. The provision at 252.204-7025 is inserted in solicitations that include 252.204-7021. The date boundary changes the clause prescription; it does not let a contractor choose whether an existing solicitation’s stated requirement applies.
The exception also matters. Paragraph (a) begins by referring to 32 CFR 170.5(d), which permits a waiver only in very limited circumstances by an authorized Service Acquisition Executive, Component Acquisition Executive, or delegate. The clauses exclude acquisitions solely for commercially available off-the-shelf items in the relevant period. Do not generalize either point into “commercial products are exempt”: the prescription expressly discusses FAR Part 12 commercial-product and commercial-service procedures while retaining a narrower COTS-only exclusion. A contracting officer or counsel should resolve the facts and exception for a real procurement.
What 252.204-7021 and 7025 do in the solicitation package
The clause 252.204-7021 carries the contractor’s CMMC obligations when included. Its current text covers the required status, maintaining status through the contract where required, system-specific CMMC unique identifiers, affirmations, and subcontract flowdown. The solicitation provision 252.204-7025 tells an offeror which CMMC level is required and asks for the CMMC UID or UIDs associated with systems that will handle FCI or CUI during performance. In short, 7025 communicates the solicitation’s requirement; 7021 is the contract clause that establishes the performance obligation.
The numbers are easy to confuse with 252.204-7012 and the NIST assessment provisions. A reliable clause matrix should list each one separately: 7012 for safeguarding covered defense information and incident reporting; 7021 for CMMC status requirements when prescribed and included; 7025 for the solicitation notice when 7021 is included; and 252.240-7997 for NIST SP 800-171 DoD Assessment requirements under the new Part 240 prescription. Do not assume that suspension of one CMMC phase deletes the independently stated safeguarding or assessment clauses.
The Phase II suspension changed the rollout, not every contract file
On July 13, 2026, the Department publicly announced immediate suspension of Phase II requirements, which had been scheduled to begin on November 10, 2026, and said Phase I self-assessment requirements remained in place. The official CMMC status page repeats that distinction. This is strong evidence for the program’s current implementation posture, but a company still needs to inspect each live solicitation, contract, and amendment. Do not use an old slide that says Phase II automatically begins on the original date, and do not infer that all cybersecurity work can stop.
Revision 3’s cover memorandum adds the contract-administration steps behind the announcement. It directs contracting officers to collaborate with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts in accordance with the July 13 CIO memorandum. Requiring activities may include Level 1 (Self) or Level 2 (Self) assessments in procurement requests and requirements documents; the memo also requires baseline NIST SP 800-171 Rev. 2 compliance under 252.204-7012 and suspends the November 2026 Phase II transition.
For active solicitations, program managers and requiring activities are directed to initiate amendments and provide them to the contracting officer, who is to issue matching solicitation amendments as soon as practicable. For existing contracts that contain affected requirements, the memo directs removal by modification before the next option period or through the next scheduled administrative modification. A contractor should therefore request the applicable amendment or modification and keep following the signed contract while it remains unmodified; do not assume a news announcement alone has rewritten a live contract.
Follow the UID and system boundary through proposal to performance
Under the Part 240 procedures, the contracting officer checks SPRS for a current CMMC status at the required level or higher for each relevant CMMC UID. The UID is tied to the contractor information system that will process, store, or transmit FCI or CUI and be used for performance. That makes system selection part of proposal readiness. A status associated with the company’s legacy enclave does not automatically show that a newly proposed cloud tenant, acquired business unit, or remote-work environment is the system the team intends to use.
Before submission, ask technical and contracts staff to confirm the solicitation number and version, the level written in 7025, the system or systems proposed for use, each corresponding CMMC UID, the SPRS status and date, and the current affirmation. If a new UID is generated during performance, the deviation tells contracting officers to check current status for the newly identified system. Keep the inventory and system boundary current so the proposal package can be updated without guessing which record belongs to which environment.
Do not collapse CMMC status into the NIST assessment record
CMMC status and NIST SP 800-171 DoD Assessment results answer related but distinct questions. Part 240 sets out both CMMC procedures and a separate NIST assessment clause. The CMMC clauses point to the level and status required for the contractor systems in scope. The NIST assessment clause concerns a Medium or High Government review of a covered contractor information system under 252.204-7012 and has its own access, score, SPRS, and rebuttal provisions. A spreadsheet with only one field called ‘cyber score’ cannot reliably track both.
Build a separate row for each system and obligation. Record the clause, version, required level or assessment type, system boundary, UID where applicable, SPRS result, date, affirmation or rebuttal milestone, and responsible owner. Add a source link to the exact solicitation page or amendment. This lets the team see whether a CMMC record is current without confusing it with an earlier Basic or Government-led NIST assessment, and it helps explain why the same company may need multiple records for distinct systems or procurements.
A short solicitation review workflow
At intake, download the full solicitation, all cybersecurity attachments, and amendments. Search for 252.204-7012, 252.204-7021, 252.204-7025, and 252.240-7997, then note whether the document references the Part 240 deviation. Compare those references to the applicable prescription rather than relying on a clause title alone. Have contracts verify the solicitation dates and version; have security identify the relevant data; have IT map the system and UID; and have the proposal lead record the required level and deadlines.
Next, confirm the evidence in SPRS and the internal register. If the requirement is unclear, the named owner should submit a written question before the procurement’s deadline. Save both the question and answer. When the solicitation is amended, rerun the clause and system check instead of updating only the proposal narrative. After award, transfer the same record into contract operations, because a new system, UID, subcontractor, or scope change may require a fresh review rather than reuse of the bid-stage assumptions.
Practical questions to resolve before bid approval
A bid team does not need to predict future policy to produce a strong record. It needs to identify what the current procurement says, which official clause version governs, the information and system boundary proposed, the status evidence available today, and any uncertainty that requires contracting-officer clarification. Keep the original status screenshot or export with its retrieval date and limit it to authorized staff; SPRS information is not a marketing badge.
For leadership, summarize the decision in plain language: requirement, affected systems, evidence checked, unresolved issue, owner, and next trigger. A trigger might be a solicitation amendment, award, new UID, system migration, or a change to the Department’s official CMMC status page. That gives the company a reviewable basis for continuing Phase I work, adjusting an assessment schedule, or asking a focused procurement question while Phase II remains suspended.
A short working check
- ✓Save the solicitation, amendments, and the applicable September 2026 Part 240 deviation text.
- ✓Locate 252.204-7012, 7021, 7025, and 252.240-7997 separately.
- ✓Record the level stated in 7025 and the CMMC UID for every proposed system.
- ✓Verify current SPRS status and affirmation for those specific systems.
- ✓Escalate conflicting text in writing and retain the contracting-officer answer.
Common questions
Does the Phase II suspension mean 252.204-7021 cannot appear in a solicitation?
Do not infer that from the announcement alone. Read the applicable Part 240 prescription, exception, solicitation, and amendments. The July 2026 announcement said Phase II was suspended while Phase I self-assessment requirements remained in place.
When does 252.204-7025 appear?
Under Revision 3 of DFARS Part 240, insert the provision in solicitations that include 252.204-7021. It identifies the required CMMC level and calls for relevant CMMC UID information.
Are all commercial contracts exempt from these CMMC clauses?
No. The prescription discusses commercial-product and commercial-service procedures and states a narrower exclusion for acquisitions solely for COTS items, along with the 32 CFR 170.5(d) exception. Apply the actual text to the procurement facts.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
