Task force report still pending as the Rev. 3 deviation sinks in

Top story

The CMMC Reform Task Force's recommendations still haven't been made public. The 60-day review that began July 13 wrapped up in mid-September, and as of Friday, September 25, we found no released report, no new DoW CIO memo, and no restart date for Phase 2. In the meantime, the document contractors should be reading is DFARS Class Deviation 2026-O0025, Revision 3, signed September 3. It covers far more than CMMC.

Rules and policy

The CMMC instruction, in the deviation's own words. Revision 3 supersedes Revision 2 (July 16) and tells contracting officers to "remove or revise the Cybersecurity Maturity Model Certification (CMMC) requirements in new and existing solicitations and contracts," per the DoW CIO's July 13 suspension memo. That memo permits Level 1 (Self) or Level 2 (Self), requires baseline NIST SP 800-171 Rev. 2 compliance under DFARS 252.204-7012, and suspends the November 2026 Phase 2 transition. Existing contracts are modified before the next option period or at the next administrative modification. Why it matters: self-assessments and annual affirmations remain live obligations wherever a contract includes them.
The SPRS assessment clause has a new number. In the deviation's DFARS Part 240, the NIST SP 800-171 DoD assessment clause is 252.240-7997 (FEB 2026), which covers government-led Medium and High assessments. The old 252.204-7019 and 252.204-7020 do not appear. Where a contract includes Level 1 (Self) or Level 2 (Self), the CMMC clause 252.204-7021 still requires posting a current self-assessment in SPRS. Why it matters: check which clauses your contracts actually carry before assuming what you owe SPRS.
Revision 3 reaches beyond CMMC. It directs contracting officers to use the revised FAR Part 40 and the attached DFARS Part 240 and PGI 240. It also implements section 853 of the FY2025 NDAA, barring DoD purchases from entities that knowingly supply covered semiconductor products to Huawei, and the FY2024 and FY2025 NDAA bans on selling covered DoD personnel data. Why it matters: these clauses can arrive in the same contract modifications that revise your CMMC language.
Legal guidance keeps repeating the same message. Covington's September 21 update says contractors "must continue self-assessing compliance with CMMC and NIST SP 800-171 Rev. 2 controls." Why it matters: the pause changes who checks the work, not the work itself.

Industry and enforcement

No new DOJ cyber-fraud settlements announced this week. The most recent contractor settlement we're tracking is LOGZONE Inc. of Huntsville, Alabama, which agreed on June 18, 2026 to pay $507,144 after a DCMA assessment returned an SPRS score of -170. Why it matters: an inaccurate score or affirmation is still the enforcement hook, pause or no pause.

Still on the radar

What the task force may recommend. DoW CIO Kirsten Davies told DefenseScoop on September 9 that the department received more than 1,100 RFI responses. She pointed to moving away from "point-in-time assessments" toward continuous evaluation, and to fixing inconsistent CUI marking.
Industry's read on the pause. Professional Services Council president Stephanie Kostro told Federal News Network on September 15: "This is not the death knell of CMMC."

Watch list

Release of the Reform Task Force recommendations or a new DoW CIO memo.
Any Phase 2 restart date, or proposed changes to 32 CFR Part 170 or the DFARS CMMC clauses.
Contract modifications removing C3PAO requirements at option exercise.

What to do this week

Confirm your SPRS entries and annual affirmations are current and accurate.
Read your next contract modification closely. It may revise CMMC language and add the new Part 240 clauses at the same time.
Keep closing NIST SP 800-171 gaps. Whatever the task force recommends, those requirements aren't going away.

Sources

This briefing summarizes public sources for general awareness. It is not legal advice. Check the linked primary sources before acting on any item.

All weekly briefings