DoW Revises CMMC Suspension and Adds Three Supply-Chain Bans

The Department of War published Revision 3 of its Class Deviation on September 3, 2026. It consolidates four requirements into a single Part 240 directive, and if that sounds like a compliance director's weekend-ruiner, that's because it is.

The CMMC piece is the one contractors have been tracking since July, when the DoW CIO suspended the November 2026 transition to Phase 2. Revision 3 retains those instructions: contracting officers must remove or revise third-party assessment requirements in both new contracts and existing solicitations. NIST SP 800-171 Revision 2 compliance remains mandatory. The suspension doesn't touch Phase 1 self-assessments, which stay in place.

That's the third time in roughly 18 months that DoW has rewritten its CMMC implementation path. Revision 1 established the initial class deviation framework. Revision 2 incorporated the July CIO suspension memo. Now Revision 3 carries that suspension forward while layering in three unrelated procurement bans, a bundling move that signals the department wants contracting officers enforcing all four requirements through one compliance vehicle rather than managing separate deviations.

What's new in Revision 3

Three statutory prohibitions land alongside the CMMC suspension:

First, Section 853 of the FY 2025 NDAA bars DoW from contracting for covered semiconductor products or services with any entity that knowingly supplies Huawei, its subsidiaries, or any entity Huawei directly or indirectly controls. "Covered" here means semiconductors, semiconductor manufacturing equipment, and semiconductor design tools, not just finished chips.

Second, Sections 803 (FY 2024) and 836 (FY 2025) prohibit contractors from transferring covered individually identifiable DoW employee data to anyone other than the federal government, with three narrow exceptions: when the transfer is necessary to perform the contract, when a waiver authorizes it, or when otherwise permitted by law. The implementing clause applies to PII of DoW employees including armed forces members, and the Covington analysis notes it flows down to subcontracts.

Third, Sections 817 (FY 2023) and 848 (FY 2020) ban the procurement and use of certain unmanned aircraft systems (and counter-UAS detection systems) manufactured by entities from China, Russia, Iran, or North Korea. Section 848 originated the core ban focused on China; Section 817 expanded both the country list and the covered system types.

One definitional fix

Revision 3 also corrects an overreach from Revision 2. The prior version defined "Chinese military company" broadly, pulling from multiple U.S. government lists. Revision 3 narrows the definition to entities actually designated under Section 1260H, the DoW roster of Chinese military companies operating in the United States. More than twenty new parent-level designations were added to that list in 2026.

There's one carveout: a Northern District of California court order temporarily bars DoW from applying the covered-lobbyist prohibition to Alibaba while the company's challenge to its 1260H designation proceeds. The relief doesn't affect Alibaba's treatment as a Chinese military company for other purposes.

What to do Monday

For primes and subs, this is a screening exercise. The semiconductor prohibition means supply-chain diligence now has to trace whether any entity in the chain knowingly supplies Huawei, a question that demands more than a one-time supplier survey. The employee-data transfer ban requires internal controls governing where and how covered PII moves, with subcontractors included in that obligation. And the UAS ban means checking whether any equipment in operational use falls within the expanded country-of-origin restrictions.

For contracting officers, the immediate task is revising existing contracts to strip or alter C3PAO assessment language while layering in the new prohibitions. How DoW expects both changes to happen simultaneously, at scale, without guidance on sequencing, is the open operational question. The CIO's broader CMMC review (framed as aligning the program with Secretary Hegseth's Acquisition Transformation System directives) runs in parallel. Whether the Phase 2 suspension extends past November 2026 likely depends on what that review produces.