1
00:00:00,000 --> 00:00:01,695
Here's a detail that caught my attention.

2
00:00:02,206 --> 00:00:07,860
Class Deviation 2026 O0025 is now on
Revision 3, signed September 3,

3
00:00:07,906 --> 00:00:12,074
2026, by John Tenaglia, Principal Director
for Defense Pricing,

4
00:00:12,109 --> 00:00:14,002
Contracting, and Acquisition Policy.

5
00:00:14,327 --> 00:00:16,904
It supersedes Revision 2 from July 16.

6
00:00:17,183 --> 00:00:19,841
Most people hear that and file it under
CMMC.

7
00:00:20,120 --> 00:00:21,362
Is that the right drawer?

8
00:00:21,375 --> 00:00:22,175
Only partly.

9
00:00:22,255 --> 00:00:24,655
And that's where contractors get into
trouble.

10
00:00:24,715 --> 00:00:30,415
The deviation operationalizes FAR Part 40
and DFARS Part 240,

11
00:00:30,462 --> 00:00:33,295
Information Security and Supply Chain
Security.

12
00:00:33,575 --> 00:00:35,535
CMMC is one piece of it.

13
00:00:35,615 --> 00:00:40,495
But before we get to what's inside, we
need to settle what a class deviation is,

14
00:00:40,535 --> 00:00:42,975
because that's the first place people go
wrong.

15
00:00:43,000 --> 00:00:43,522
Go ahead.

16
00:00:43,731 --> 00:00:44,347
What is it?

17
00:00:44,375 --> 00:00:46,695
It's an instruction to contracting
officers.

18
00:00:46,855 --> 00:00:53,815
It tells them to use specific revised text
in place of what's codified in 48 CFR.

19
00:00:53,904 --> 00:00:59,735
Revision 3 says contracting officers must
use the revised FAR Part 40,

20
00:00:59,755 --> 00:01:04,455
the revised DFARS Part 240, and the
revised PGI.

21
00:01:04,615 --> 00:01:07,655
It is addressed to the government's
acquisition leadership.

22
00:01:07,842 --> 00:01:13,015
It is not addressed to you, and it does
not amend your contract by itself.

23
00:01:13,148 --> 00:01:17,495
My interpretation of this is that a class
deviation is a directive,

24
00:01:17,595 --> 00:01:21,575
and a contract modification is the
executed document.

25
00:01:21,682 --> 00:01:27,095
Until the second one exists, your contract
file says what it said before.

26
00:01:27,292 --> 00:01:30,218
So the policy can change while the paper
stays the same.

27
00:01:30,250 --> 00:01:30,890
Exactly.

28
00:01:30,986 --> 00:01:32,730
Take the CMMC piece.

29
00:01:32,810 --> 00:01:39,050
The Chief Information Officer's memo of
July 13, 2026, suspended the advancement to

30
00:01:39,170 --> 00:01:43,370
CMMC Phase 2 and the November 2026
transition.

31
00:01:43,450 --> 00:01:48,530
It permits Level 1 Self or Level 2 Self
assessments in procurement requests.

32
00:01:48,580 --> 00:01:52,410
The deviation tells contracting officers
to act on that memo.

33
00:01:52,470 --> 00:01:57,370
For active solicitations, program managers
and requiring activities initiate

34
00:01:57,421 --> 00:02:01,850
amendments, and contracting officers issue
the corresponding amendments as soon as

35
00:02:01,903 --> 00:02:02,810
practicable.

36
00:02:02,874 --> 00:02:04,010
That's the fast path.

37
00:02:04,042 --> 00:02:06,085
And for contracts that are already
awarded?

38
00:02:06,125 --> 00:02:08,045
Slower, by design.

39
00:02:08,125 --> 00:02:12,605
For existing contracts that contain these
requirements, contracting officers must

40
00:02:12,662 --> 00:02:17,405
remove them by modification prior to
exercising the next option period,

41
00:02:17,485 --> 00:02:20,365
or through the next scheduled
administrative modification.

42
00:02:20,498 --> 00:02:21,805
Whichever comes first.

43
00:02:22,045 --> 00:02:25,485
If your option year is two months out,
you'll see it soon.

44
00:02:25,618 --> 00:02:30,605
If your contract has no option and no
administrative modification on the calendar,

45
00:02:30,637 --> 00:02:34,525
that legacy Phase 2 language can sit in
your file for months.

46
00:02:34,596 --> 00:02:35,965
Possibly more than a year.

47
00:02:36,093 --> 00:02:40,685
That's the realistic reading of the
timing, not a number in the deviation itself.

48
00:02:40,708 --> 00:02:41,997
Which sounds like a trap.

49
00:02:42,600 --> 00:02:47,163
A contractor reads the old clause in the
file and assumes the third party assessment

50
00:02:47,221 --> 00:02:48,185
is still coming.

51
00:02:48,208 --> 00:02:51,808
Or assumes the opposite and relaxes
everything.

52
00:02:51,888 --> 00:02:53,008
Both are mistakes.

53
00:02:53,088 --> 00:02:57,888
The suspension is policy, and enforcement
of third party certification under Phase 2

54
00:02:57,968 --> 00:02:58,768
is halted.

55
00:02:58,868 --> 00:03:00,688
But the paperwork lags.

56
00:03:00,795 --> 00:03:02,288
So the discipline is simple.

57
00:03:02,388 --> 00:03:04,848
Don't guess from the contract text alone.

58
00:03:04,988 --> 00:03:10,048
Ask your contracting officer in writing
where your contract sits in its option and

59
00:03:10,103 --> 00:03:11,408
modification cycle.

60
00:03:11,508 --> 00:03:14,528
And when a modification does arrive, read
it.

61
00:03:14,618 --> 00:03:17,328
Confirm it removes exactly what you
expect.

62
00:03:17,333 --> 00:03:19,191
And what doesn't move while you wait?

63
00:03:19,208 --> 00:03:23,848
DFARS 252.204 7012.

64
00:03:24,061 --> 00:03:26,328
It stays fully mandatory.

65
00:03:26,424 --> 00:03:32,968
That means baseline compliance with NIST
SP 800 171 Revision 2 and the

66
00:03:33,048 --> 00:03:35,928
72 hour cyber incident reporting
requirement.

67
00:03:36,008 --> 00:03:39,768
Self assessments still go into SPRS.

68
00:03:39,808 --> 00:03:44,888
Those are the brilliant basics: MFA,
encryption, logging, patching.

69
00:03:44,968 --> 00:03:47,288
The suspension doesn't touch any of it.

70
00:03:47,292 --> 00:03:48,372
Now the bigger point.

71
00:03:48,883 --> 00:03:50,752
You said this isn't just a cyber document.

72
00:03:50,775 --> 00:03:52,215
What else is bundled in there?

73
00:03:52,250 --> 00:03:54,730
This is an area with issues for sure!

74
00:03:54,810 --> 00:03:59,290
The revision cites a list of separate
statutes, and each one triggers on its own

75
00:03:59,383 --> 00:04:00,170
facts.

76
00:04:00,303 --> 00:04:03,450
First, personally identifiable
information.

77
00:04:03,520 --> 00:04:10,410
Section 803 of the FY 2024 NDAA and
Section 836 of the FY

78
00:04:10,570 --> 00:04:17,050
2025 NDAA prohibit contractors from
selling, licensing, or otherwise transferring

79
00:04:17,110 --> 00:04:22,810
covered individually identifiable DoD
employee data to anyone other than the Federal

80
00:04:22,854 --> 00:04:23,450
Government.

81
00:04:23,517 --> 00:04:24,891
There are three exceptions.

82
00:04:25,077 --> 00:04:30,010
It's needed to perform the contract,
there's a waiver, or the transfer is otherwise

83
00:04:30,075 --> 00:04:31,530
authorized by law.

84
00:04:31,542 --> 00:04:33,307
And there's a clause tied to that?

85
00:04:33,333 --> 00:04:40,053
Per the summary of this deviation, it's
DFARS 240.374 with the clause

86
00:04:40,213 --> 00:04:47,173
at 252.240 7992, and it flows down to
commercial

87
00:04:47,253 --> 00:04:47,653
items.

88
00:04:47,733 --> 00:04:48,893
That matters.

89
00:04:49,033 --> 00:04:53,573
A commercial subcontractor who never
thought of itself as a defense supplier,

90
00:04:53,673 --> 00:04:58,293
say a data broker or a software vendor
that touches employee records,

91
00:04:58,360 --> 00:05:00,693
could end up with a flowdown obligation.

92
00:05:00,783 --> 00:05:03,653
Nothing about it is a cybersecurity
control.

93
00:05:03,760 --> 00:05:07,013
It's a restriction on what you may do with
the data.

94
00:05:07,333 --> 00:05:11,513
So a company with a perfect 800 171
posture could still violate it.

95
00:05:11,542 --> 00:05:12,102
Correct.

96
00:05:12,216 --> 00:05:16,262
Secure systems and lawful data use are
different questions.

97
00:05:16,422 --> 00:05:18,742
Next, semiconductors.

98
00:05:18,782 --> 00:05:25,702
Section 853 of the FY 2025 NDAA prohibits
procuring covered semiconductor products

99
00:05:25,722 --> 00:05:31,382
and services for DoD from any entity that
knowingly provides them to Huawei.

100
00:05:31,430 --> 00:05:33,262
That's a supplier tracking problem.

101
00:05:33,312 --> 00:05:36,582
You need to know who is in your chain and
who they sell to.

102
00:05:36,583 --> 00:05:38,394
That's a hard thing to know, honestly.

103
00:05:38,417 --> 00:05:39,577
It is.

104
00:05:39,697 --> 00:05:42,257
Then unmanned aircraft systems.

105
00:05:42,327 --> 00:05:48,737
Section 848 of the FY 2020 NDAA and
Section 817 of the FY

106
00:05:48,897 --> 00:05:55,057
2023 NDAA prohibit the use and procurement
of certain unmanned aircraft systems and

107
00:05:55,097 --> 00:05:57,857
certain systems for detecting and
identifying them.

108
00:05:57,964 --> 00:06:02,177
Again, that's a bill of materials
question, not a network question.

109
00:06:02,208 --> 00:06:05,319
And then there's the Alibaba item, which
seems like an odd fit.

110
00:06:05,333 --> 00:06:06,453
It's very specific.

111
00:06:06,653 --> 00:06:11,493
A court order in Alibaba Group Holding
Limited versus the Department of Defense,

112
00:06:11,605 --> 00:06:18,533
case number 26 cv 6227 EKL in the Northern

113
00:06:18,577 --> 00:06:25,493
District of California, dated July 5,
2026, temporarily waives the prohibition at

114
00:06:25,573 --> 00:06:26,613
10 U.S.C.

115
00:06:27,013 --> 00:06:32,453
4663 for Alibaba Group Holding Limited and
Alibaba Group U.S.

116
00:06:32,533 --> 00:06:32,853
Inc.

117
00:06:32,942 --> 00:06:38,213
Contracting officers don't apply the
Chinese military company or covered lobbyist

118
00:06:38,260 --> 00:06:40,613
definitions to them for that purpose.

119
00:06:40,673 --> 00:06:44,613
The waiver lasts until the court resolves
the motion for a temporary restraining

120
00:06:44,666 --> 00:06:50,693
order and preliminary injunction, or 60
days after a hearing on that motion,

121
00:06:50,733 --> 00:06:51,893
whichever comes first.

122
00:06:52,013 --> 00:06:57,093
For every other purpose, they're still
treated as a Chinese military company based

123
00:06:57,120 --> 00:06:59,013
on the 1260H listing.

124
00:06:59,093 --> 00:07:02,853
That's a narrow, temporary carve out, and
it could change.

125
00:07:02,875 --> 00:07:04,965
Why would one document carry all of that?

126
00:07:05,000 --> 00:07:09,880
Because Part 40 is Information Security
and Supply Chain Security,

127
00:07:09,900 --> 00:07:14,921
and the overhaul policy is to keep what's
required by statute or essential to sound

128
00:07:14,968 --> 00:07:15,561
procurement.

129
00:07:15,721 --> 00:07:20,761
The deviation cites Executive Order 14275
for that.

130
00:07:20,921 --> 00:07:24,041
It's a regulatory vehicle, not a cyber
rule.

131
00:07:24,161 --> 00:07:28,441
And it's on its third revision, which
includes corrections to the definitions of

132
00:07:28,491 --> 00:07:31,681
covered lobbyist and Chinese military
company.

133
00:07:31,801 --> 00:07:33,801
So treat it as a live document.

134
00:07:33,833 --> 00:07:35,551
Give me the operating checklist.

135
00:07:35,583 --> 00:07:35,903
One.

136
00:07:36,023 --> 00:07:40,703
Split the deviation clause by clause and
map each to your contracts.

137
00:07:40,863 --> 00:07:41,423
Two.

138
00:07:41,521 --> 00:07:45,343
Identify which flowdowns reach your
commercial subcontracts,

139
00:07:45,401 --> 00:07:47,663
especially the employee data restriction.

140
00:07:47,783 --> 00:07:48,463
Three.

141
00:07:48,583 --> 00:07:52,143
Track suppliers for semiconductor and
drone exposure.

142
00:07:52,303 --> 00:07:53,343
Four.

143
00:07:53,443 --> 00:07:58,463
Ask your contracting officer where each
contract sits in its option and modification

144
00:07:58,530 --> 00:07:59,103
cycle.

145
00:07:59,203 --> 00:08:00,063
And five.

146
00:08:00,175 --> 00:08:02,863
Keep doing your 800 171 work.

147
00:08:02,963 --> 00:08:05,743
The paperwork will catch up with the
policy.

148
00:08:05,807 --> 00:08:08,143
Your obligations don't wait for it.