CMMC Self-Assessment Is Now Official: What DFARS Class Deviation 2026-O0025 Revision 3 Means for Contractors

If you’ve been waiting for the CMMC Reform Task Force to say something concrete, September delivered two pieces of news at once. On September 3, 2026, the Department of War reissued a binding class deviation, DFARS 2026-O0025 Revision 3, that formally authorizes self-assessment across CMMC Levels 1 and 2 and pushes the universal certification mandate back from November 2026 to November 10, 2028. Then, on September 11, the Reform Task Force closed out its 60-day review after working through more than 1,100 industry comments totaling upwards of 10,000 pages. Its recommendations are now sitting with the Department of War CIO’s office, unpublished.

None of this means CMMC is dead, and it doesn’t mean the review is over either. But the rules governing your compliance posture right now are more concrete than they were even a few weeks ago, and they’re worth understanding in detail.

What Class Deviation Revision 3 Actually Changes

Revision 3 does three concrete things. First, it formally authorizes self-assessment as the compliance mechanism for CMMC Levels 1 and 2, in place of third-party C3PAO validation. Results still get scored and submitted to the Supplier Performance Risk System (SPRS), but the verification burden now sits squarely with the contractor. Second, it pushes back the date CMMC requirements get automatically inserted into every contract touching Federal Contract Information or Controlled Unclassified Information, from November 2026 to November 10, 2028. Between now and then, a contracting officer adds CMMC language only when the specific program office determines a contractor needs a stated level, not by default. Third, and easy to miss: Revision 3 keeps NIST SP 800-171 Revision 2 as the compliance baseline. If you’ve seen coverage of NIST SP 800-171 Revision 3 and assumed it now applies to your CMMC assessment, it doesn’t yet. That transition hasn’t been triggered.

The Reform Task Force’s Review Is Done. The Recommendations Aren’t Public.

The Task Force’s 60-day clock ran out on September 11, 2026. By all accounts it was a substantial review: over 1,100 responses to its Request for Information, more than 10,000 pages of industry input, and reportedly majority support for continuing the pause rather than reinstating Phase 2 as originally written. Its findings have gone to the Department of War CIO’s office. They have not been made public.

Industry observers are watching for one of a few outcomes: Phase 2 resuming largely as designed but on a delayed schedule; a narrower version that reserves third-party assessment for larger or higher-risk contractors while smaller firms continue under self-assessment; a model built primarily around self-assessment plus executive attestation, with third-party review reserved for a slice of the Defense Industrial Base; or a more structural redesign of the certification tiers themselves. Nobody outside the Department knows yet which direction the report will point. What Revision 3 tells us is that the Department is comfortable making self-assessment the default while that question gets settled.

What Hasn’t Moved

The core compliance obligation is untouched. DFARS 252.204-7012 still requires contractors handling covered defense information to implement all 110 security controls in NIST SP 800-171 and to report cyber incidents. FAR 52.204-21’s basic safeguarding requirements remain active for a broader population of contractors handling Federal Contract Information. CMMC Phase 1 self-assessment obligations are unaffected: organizations still score themselves against Level 1 or Level 2 requirements, submit that score to SPRS, and have a senior official sign an annual affirmation. And the government’s authority to conduct its own assessment, which takes precedence over a contractor’s self-assessment when it happens, remains fully intact.

That last point cuts against the instinct to relax. With self-assessment now the default mechanism for more of the contractor base than before, False Claims Act exposure for an inaccurate SPRS score is arguably a bigger risk today, not a smaller one. A paused certification requirement has never meant paused enforcement risk.

What This Means If You’re Handling CUI Right Now

Confirm your current SPRS score actually reflects evidence you could defend in a government assessment, not an optimistic read of where you’d like to be. Keep your System Security Plan and POA&M current and dated, since documented evidence is what separates a defensible self-assessment from a liability problem. If you have a contract award, option exercise, or extension coming up, confirm with the specific program office what CMMC level, if any, it actually requires, since Revision 3 ended the blanket insertion of CMMC language into every qualifying contract. And hold off on committing significant budget to a new third-party assessment until the Task Force’s recommendations are public, but don’t use that uncertainty as a reason to pause NIST SP 800-171 remediation work that was already overdue. That work was never contingent on Phase 2.

CMMC’s certification mechanics are still being rewritten. The security bar defense contractors are expected to clear is not. If you want a clear, evidence-based read of where your organization actually stands against NIST SP 800-171 and CMMC Level 2 today, under Revision 3 or whatever the Reform Task Force recommends next, Custom Cybersecurity Solutions can help you find out.