Contracting Officer Rev 3 Guide to CMMC Implementation

Contracting Officer Rev 3 implementation is the question most contractors are asking about Class Deviation 2026-O0025 Revision 3. Are a contract's CMMC requirements still enforceable? The question the contract itself answers is narrower: has a specific Contracting Officer issued a specific modification that specifically removes the specific language in question?

The gap between those two questions is where contractor confusion is concentrating in November 2026. A regulation that directs removal is not the same thing as a modification that executes it. Revision 3 is the first; the second is a field-level action that takes a specific amount of time, follows a specific routing path, and carries a specific set of discretionary decisions by three different roles. What a contractor sees is not inconsistent behavior across Contracting Officers. It is three different routing paths completing at three different speeds.

This article walks the Revision 3 instruction chain exactly as the memo lays it out, describes what the chain is producing at the field level, and sets out what a contractor should do with the picture.

The One-Sentence Summary

Revision 3 instructs removal. A Contracting Officer executes removal. Those are different actions, timed differently, and the contractor's contract file is where the second one actually matters.

The Three-Role Instruction Chain

Revision 3 does not direct Contracting Officers to act alone. The memo specifies a three-role chain in which each role has a distinct responsibility and distinct timing.

Three features of this chain deserve attention because they produce most of the variation contractors observe.

1. The chain is sequential, not parallel. The Contracting Officer cannot issue an amendment until the requiring activity has routed removal documentation through the program manager. Where a requiring activity is slow to prepare documentation, the Contracting Officer is not idle; the Contracting Officer is waiting.
2. “As soon as practicable” carries real meaning. The phrase is federal acquisition terminology for prompt but not immediate, scaled to the workload and complexity of the specific action. A Contracting Officer managing a significant portfolio of active solicitations may issue amendments in a prioritized sequence rather than simultaneously.
3. Existing contracts have a different clock. For contracts already in performance, Revision 3 does not direct immediate removal. It directs removal “before the next option exercise or through the next scheduled administrative modification.” A contract with no planned modification in the next six months may carry its original CMMC language for most of that period.

What That Produces at the Field Level

The three-role chain and the different timing languages for solicitations and contracts together produce four observable patterns in the field.

Active solicitations: amendments arriving in sequence

For solicitations still in the pre-award phase, contractors are receiving amendments that remove or revise CMMC Level 2^* (C3PAO) and Level 3 language. These amendments typically arrive in sequence rather than in a single wave, because requiring activities are initiating removal documentation on their own cadence.

A contractor with multiple proposals in evaluation against different Department of War buying offices may receive amendments days or weeks apart. The gap is not favoritism or inconsistency; it is the normal variability of acquisition shops working at different speeds. The useful posture is to confirm receipt of the amendment through the standard solicitation channels rather than assume removal because policy has changed.

Existing contracts: the modification is deferred, not automatic

For contracts already awarded that contain CMMC Level 2^* (C3PAO) or Level 3 language, Revision 3 directs removal “before the next option exercise or through the next scheduled administrative modification.” That direction does three things worth separating.

• It establishes that removal will occur. A contract containing the affected language will be modified to remove it. The question is when, not whether.
• It attaches removal to a scheduled event. The Contracting Officer does not open the contract file to issue a standalone modification. The removal is bundled into the next administrative action that would have occurred anyway, which is more efficient for the acquisition workforce but produces a wait for the contractor.
• It leaves original language in place in the interim. A contract still carries its original CMMC clause until the modification issues. For a contractor evaluating whether to invest in readiness activities during the interim, the original language is the authoritative statement of contractual obligation.

Mixed portfolios: carrying both numbering sets

A contractor holding contracts awarded at different times may carry the legacy DFARS 252.204-7019 and 252.204-7020 structure on some contracts, the November 2025 structure with 252.204-7021 on others, and the deviation-era 252.240-7997 on the most recent awards. The clause-level treatment of this is covered in detail in our article on the clause numbers changed. The field-level implication is that a contractor cannot assume uniform treatment across its portfolio; each contract must be read against its own clause set.

Variation by buying office and program type

Different buying offices are completing the routing chain at different speeds. This is normal and not a sign of enforcement variation. A heavily resourced acquisition shop with concentrated CMMC exposure may have cleared its active solicitation backlog by late October. A smaller shop with fewer affected solicitations may still be in process. For a contractor tracking status across multiple buying offices, the useful record is whether a specific amendment has issued, not whether other offices have moved faster.

What Not to Infer from the Deviation Alone

Three misreadings of Revision 3 are particularly costly, and each of them follows from treating the deviation as a one-step action rather than as the first step in a chain.

1. “The clause is already gone.” No. The deviation directs removal. A Contracting Officer executes removal. Until the specific modification issues, the original clause in the specific contract remains the authoritative statement of what the contractor agreed to.
2. “Existing contracts are modified immediately.” No. Revision 3 attaches removal to the next option exercise or scheduled modification. A contract with no imminent modification planned may carry its original language for months.
3. “Policy change automatically overrides original solicitation text.” No. Until a formal solicitation amendment issues, the original solicitation text controls what a contractor is representing when it submits a proposal. A contractor submitting against original language without acknowledging the policy direction is in a different position from one who has confirmed the amendment with the Contracting Officer.

The exposure that persists through this interim period is the exposure that has been the central concern since the suspension began. A current and accurate SPRS score, documented against an environment that matches the posted score, is the fundamental protection against the risk the self-assessment period concentrates. This is covered in detail in our article on why self-assessment raised liability rather than lowered it.

What a Contractor Should Do

Four actions align the contractor's posture with how Revision 3 actually plays out in the field. None require the Task Force report to be published, and none depend on any specific restart timing.

For active solicitations

1. Confirm receipt of the amendment through the formal solicitation channel. Checking the solicitation on SAM.gov or the appropriate contracting system is the authoritative record. A policy announcement is not an amendment. A contractor's assumption is not an amendment. The formal amendment is the amendment.
2. If the amendment has not arrived and a proposal is due, raise the specific provision with the Contracting Officer. The appropriate request is to understand which amendment addresses the CMMC language and when it is expected. A Contracting Officer under the “as soon as practicable” timing standard will often respond with a specific expectation. That response becomes part of the record.

For existing contracts

3. Identify which clause set each contract carries today. Pull the contract file for each active contract and record the specific CMMC clause citations present. Three sets are in circulation (legacy, November 2025, deviation-era), and a contractor may hold all three across its portfolio.
4. Identify the next modification trigger for each affected contract. The next option exercise date or scheduled administrative modification is when removal will occur. A contract with an option exercise in Q1 2027 will carry its original language through most of this calendar quarter. Knowing that date makes the readiness planning finite rather than open-ended.

One Useful Posture Check

If the Contracting Officer for a specific active contract or solicitation were asked when the CMMC-affected amendment or modification will issue, could the organization produce the Contracting Officer's response in writing within one business day?

Where the answer is no, the organization is inferring the amendment timing rather than confirming it.

How KSG Approaches This Work

Kaizen Solutions Group has secured federal and state government systems since 2016. We are an SBA 8(a)-certified small disadvantaged business, ISO 27001:2022, ISO 9001:2015 and ISO 20000-1:2018 certified, and we hold GSA HACS designations across all five categories: Risk and Vulnerability Assessment, High Value Asset assessment, Penetration Testing, Incident Response, and Cyber Hunt.

Our position on the current period is that the authoritative record of what a contractor owes is in the contract file, not in the regulation and not in the trade press. The work of cataloging what each contract actually carries, tracking amendments as they arrive, and documenting the response from the Contracting Officer when amendment timing is unclear is the work that keeps a contractor's compliance position defensible through a period of regulatory change.

Where we typically begin

• Contract clause and obligation review — We catalog which clause set each active contract carries, which modifications have been issued, and which contracts have outstanding affected language.
• Amendment tracking and Contracting Officer coordination support — We help organizations document the status of expected amendments, the record of inquiries raised with Contracting Officers, and the resulting correspondence, so that the contractor's position is documented rather than inferred.
• SPRS score reconciliation and gap assessment — We assess the environment against all 110 NIST SP 800-171 controls and reconcile the result against the posted score, because the self-assessment exposure persists regardless of the amendment timing.
• System Security Plan and POA&M development — We produce documentation that describes the environment, the boundary and the deficiencies accurately enough to hold up under Government-led review.
• Risk Management and POA&M analytics — We deliver continuous monitoring, vulnerability and patch management, Cybersecurity Supply Chain Risk Management, and Key Risk Indicator and Key Performance Indicator dashboards.
• Security operations and remediation delivery — We support Security Operations Center monitoring, SIEM and SOAR, penetration testing, incident response, Identity and Access Management, endpoint detection and response, and DevSecOps.

A Useful Place to Begin

One question produces most of the answer. For each active contract carrying CMMC language, when is the next option exercise or scheduled administrative modification, and has the Contracting Officer confirmed the removal will issue at that event?

Where either half of that question cannot be answered quickly, the contractor's position is documented informally rather than formally, and informal documentation is weaker than what Rev 3 makes available.

Talk to our team · Download our capability statement · Explore CMMC Level 2^* readiness

Frequently Asked Questions

Does Revision 3 remove the CMMC clause from a contract automatically?

No. Revision 3 directs Contracting Officers to remove or revise CMMC Level 2^* (C3PAO) and Level 3 requirements. The removal is executed through a specific solicitation amendment or contract modification. Until that formal action issues, the original clause in the specific contract remains the authoritative statement of what the contractor agreed to.

How long does a Contracting Officer have to issue a solicitation amendment under Rev 3?

For active solicitations, Revision 3 says the Contracting Officer must issue the corresponding amendment “as soon as practicable” after receiving the removal documentation from the requiring activity, routed through the program manager. “As soon as practicable” is federal acquisition terminology for prompt but not immediate, scaled to the workload and complexity of the specific action. Contracting Officers managing large portfolios may issue amendments in a prioritized sequence rather than simultaneously.

What does “before the next option exercise or scheduled administrative modification” mean for existing contracts?

For contracts already awarded that contain CMMC Level 2^* (C3PAO) or Level 3 language, Revision 3 attaches removal to a scheduled event rather than directing immediate modification. The Contracting Officer will remove the affected language at the next time they open the contract file for an administrative purpose, typically either an option exercise or a scheduled administrative modification. A contract with no imminent modification planned may carry its original CMMC language for months.

Is the modification bilateral or unilateral?

It depends on the contract and the type of change. Many administrative modifications of this kind are unilateral, issued by the Contracting Officer on the government side without requiring contractor signature. Where the change affects performance or deliverables materially, a bilateral modification may be required. The specific contract's modification history and the Contracting Officer's direction will indicate which path applies. Contractors should not assume unilateral action.

What should a contractor do if a current solicitation still references Level 2 (C3PAO) requirements?

Confirm receipt of the formal amendment through the standard solicitation channel. If an amendment has not arrived and a proposal is due, raise the specific provision with the Contracting Officer in writing, requesting information about which amendment addresses the CMMC language and the expected timing. The Contracting Officer's response becomes part of the record. Do not assume removal has occurred without documentation.

If my contract has a CMMC clause in it today, is my CMMC obligation suspended?

The regulatory position is that Level 2 (C3PAO) and Level 3 third-party assessment requirements in solicitations and contracts are directed to be removed. The contractor's obligation under the specific contract follows the specific text of the specific contract until it is modified. A contractor whose contract has not yet been modified continues to carry the original clause's requirements, though those requirements may not be enforced in the current environment given the Department's suspension direction. The careful position is to continue readiness work and confirm the modification when it issues.

Who initiates the removal — the Contracting Officer or someone else?

Under Rev 3, the requiring activity initiates. The requiring activity prepares documentation explicitly removing the CMMC Level 2^* (C3PAO) or Level 3 requirements, and the program manager routes that documentation to the cognizant Contracting Officer. The Contracting Officer then issues the amendment. This chain explains most of the variation contractors observe: the Contracting Officer cannot act until the requiring activity has prepared and routed the removal.

Does Rev 3 change what a contractor owes under NIST SP 800-171?

No. Revision 3 addresses the CMMC assessment requirements that would have been triggered by Phase 2. It does not modify DFARS 252.204-7012, which continues to require adequate security and 72-hour cyber incident reporting. NIST SP 800-171 Revision 2 continues to apply to covered contractor information systems. The annual affirmation continues to require a senior official's signature. The deviation changed the verification mechanism, not the underlying security requirement.