Get tomorrow's brief in your inbox
Today: DoD's new class deviation confirms baseline DFARS 7012 and NIST 800-171 Rev 2 compliance remain mandatory during the CMMC Phase 2 suspension, practitioners are debating whether to continue C3PAO prep or pause, and FIPS mode implementation for control 3.13.11 is surfacing painful config-change tradeoffs.
DoD issued an 80+ page class deviation last week clarifying contracting officer instructions during the CMMC Phase 2 suspension. Federal News Network interviewed Stephanie Kostro, who walked through what the deviation is and is not. (Source)
What remains mandatory: - DFARS 252.204-7012 (safeguarding requirements) - NIST SP 800-171 Revision 2 compliance - Supplier Performance Risk System (SPRS) scoring - Annual affirmation of compliance - CMMC Level 1 (Self) and Level 2 (Self) pathways via self-assessment
What is suspended: - Third-party C3PAO assessments (the Phase 2 transition to outside assessors) - CMMC Level 3 - Any contract language requiring C3PAO certification
The deviation requires contracting officers to update active solicitations with line-in/line-out changes reflecting these rules. Kostro emphasized this is "not the death knell of CMMC" and dispelled rumors that the suspension guts cybersecurity requirements. The core self-assessment pathway and 800-171 Rev 2 controls are still the floor.
Action: If you are mid-solicitation or negotiating flow-downs, expect updated contract language removing C3PAO cert requirements but retaining self-assessment and SPRS obligations. Update your SSP and POA&M to reflect current 800-171 Rev 2 posture. The annual affirmation requirement has not changed.
Watch: The Reform Task Force review timeline and whether the suspension becomes permanent policy or a temporary pause before a modified Phase 2 rollout. The rulemaking comment window closed last week; DoD has not published a timeline for task force findings.
C3PAO demand during the pause: A Reddit thread asked C3PAOs and contractors what they are seeing post-suspension. Are companies canceling or delaying assessments? Are contractors continuing CMMC prep or holding off? (Source) No clear consensus emerged in the thread as of this morning, but the question reflects real budget and planning uncertainty. If your org was planning a Q4 2026 or Q1 2027 C3PAO assessment, this is decision time: continue prep as a dry run, pause and reallocate budget, or wait for task force clarity.
Post-assessment Rev 3 migration: Another practitioner asked whether anyone who recently passed a CMMC assessment has started copying their Rev 2 SSP and transitioning it to Rev 3 to stay ahead. (Source) Rev 3 is not yet required by contract, but starting the gap analysis and SSP revision now (while Rev 2 is fresh) could smooth the eventual transition. If you have the bandwidth and recently documented your Rev 2 environment, this is a low-risk way to prepare for the next standard shift.
FIPS mode implementation pain: A contractor posted about NIST SP 800-171 control 3.13.11 (Employ FIPS-validated cryptography). Their Palo Alto firewalls, Aruba switches, and access points all support FIPS mode but were never enabled. The challenge: enabling FIPS mode post-deployment can break existing VPN and IPsec tunnels, requiring device re-enrollment and config changes that risk downtime. (Source) This is a known friction point. Equipment that supports FIPS but is not running in FIPS mode creates assessment risk, but flipping the switch in production without a maintenance window and rollback plan can cause outages. If you are in this position, plan a staged cutover: test in a lab environment first, document the re-enrollment procedure, schedule the change during a maintenance window, and have a backout plan.
Physical security (employee badges): A contractor asked for vendor recommendations for employee badge systems (not for door access, just visual ID to meet physical security controls). (Source) This is a straightforward control (3.10.1, limit physical access), but if you are scaling to 200+ employees and do not know every face, badges are the default path. Look for vendors with quick turnaround and batch printing; avoid printing 200 badges in-house unless you have the time and equipment.
Bottom line: The class deviation confirms what stays and what is suspended. Self-assessment and 800-171 Rev 2 are still the baseline. The uncertainty is whether to invest in C3PAO prep now or wait, and whether to tackle disruptive config changes (like FIPS mode enablement) before or after the Reform Task Force reports. If your contracts require SPRS scores and annual affirmations, those obligations have not changed. If you were banking on self-assessment staying the only pathway indefinitely, do not. The suspension is a pause, not a repeal.