Defense contractors chasing CMMC Level 2 certification can stand down DoD-wide, and Alibaba just got a temporary pass from the Pentagon's "Chinese military company" blacklist — both moves landing in the same regulatory document. The Class Deviation 2026-O0025, Revision 3 memorandum, issued September 3, 2026 by the Office of the Assistant Secretary of War (Acquisition and Sustainment), revises and supersedes Revision 2 from July 16, 2026 and takes effect immediately across every branch and defense agency.
The deviation governs Revolutionary FAR Overhaul Part 40 and DFARS Part 240, the sections covering information security and supply chain security. It went out to CYBERCOM, SOCOM, TRANSCOM, the Army, Navy and Air Force procurement executives, and every defense field activity director, which means the change reaches virtually every contracting office writing cybersecurity language into a solicitation.
What Changes for CMMC Level 2 Contractors
The deviation permits contracting officers to accept CMMC Level 1 (Self) or Level 2 (Self) assessments in all procurement requests and requirement documents, effectively displacing third-party C3PAO certification for the duration of the suspension. It requires only baseline compliance with NIST SP 800-171 Revision 2 under DFARS 252.204-7012, and it suspends the November 2026 transition to full CMMC Phase 2 enforcement — the deadline contractors had been building compliance programs around for more than a year.
This is not a new policy so much as a codification of one. The Department of War's Chief Information Officer issued a suspension memo on July 13, 2026 pausing the Phase 2 rollout; Revision 3 writes that pause into binding regulatory text that contracting officers must now follow. Program managers and requiring activities are directed to amend active solicitations to strip out third-party assessment requirements, and existing contracts must have those requirements removed at the next option exercise or scheduled administrative modification — meaning companies that already built C3PAO audits into their compliance budgets can drop them at the next contract touchpoint rather than waiting for a new procurement cycle.
Why the Pentagon Is Waiving the Alibaba Blacklist Rule
The same document does something unrelated on paper but consequential in practice: it tells contracting officers to temporarily not apply the "Chinese military company" and "covered lobbyist" prohibition at DFARS 240.70 — the regulatory implementation of 10 U.S.C. 4663, also known as Section 1260H — to Alibaba Group Holding Limited and its U.S. subsidiary, Alibaba Group (U.S.) Inc.
The waiver implements a federal court order. As the memo states, "This revision implements the requirements in the court's order in Alibaba Group Holding Limited, et al v U.S. Department of Defense, et al, case number 26-cv-6227-EKL (N.D. Cal), dated July 5, 2026, to temporarily waive the prohibition at 10 U.S.C. 4663 for Alibaba Group Holding Limited and Alibaba Group (U.S.) Inc." The waiver holds until the court resolves Alibaba's motion for a temporary restraining order and preliminary injunction, or for 60 days after the court holds a hearing on that motion — whichever comes first.
Alibaba's fight with the Pentagon started after the Section 1260H list added the company on June 8, 2026. Alibaba sued weeks later, on June 24, 2026, arguing the designation had no basis in fact or law. The Pentagon's designation reportedly rests on Alibaba's asserted ties to China's Assets Supervision and Administration Commission and to China's Ministry of Industry and Information Technology; Alibaba disputes that link, countering in its complaint: "A regulator is not an affiliate." Alibaba is not alone in challenging its inclusion on the list — pharmaceutical company WuXi AppTec filed a similar suit in federal court in Washington, D.C. on June 11, 2026, calling its own designation politically motivated and factually unsupported.
The Statutory Backdrop Contracting Officers Are Working Under
Revision 3 also cites the statutes driving the broader DFARS Part 240 rewrite: NDAA FY2025 Section 853, which bars DoD from procuring semiconductor products or services from any entity that knowingly supplies them to Huawei, and NDAA FY2024 Section 803 combined with FY2025 Section 836, which bar contractors from transferring covered DoD employee personally identifiable information to anyone outside the federal government except in narrow, waivable circumstances. The memo frames the whole rewrite as an application of Executive Order 14275, "Restoring Common Sense to Federal Procurement," which the deviation quotes as establishing that the FAR "should only contain provisions required by statute or essential to sound procurement, and any FAR provisions that do not advance these objectives should be removed." That deregulatory framing is the throughline connecting the CMMC rollback and the Alibaba carve-out: both amount to the Pentagon narrowing supply-chain-security requirements to the statutory floor, whether the requirement was self-imposed policy (CMMC third-party assessments) or currently under direct legal challenge (the 1260H listing).
What It Means for Contractors
For Defense Industrial Base companies that had been preparing for CMMC Level 2 third-party assessments, the practical effect is immediate relief: self-assessment against NIST SP 800-171 Revision 2 is now the operative standard DoD-wide, and the November 2026 Phase 2 deadline that many had scheduled audits around no longer applies. Contractors with active solicitations that still reference third-party C3PAO requirements should expect amendments, and those with existing contracts should watch for the requirement to disappear at the next option exercise rather than assume it persists until a new award.
For companies doing business with or competing against Alibaba's U.S. operations, the waiver is a reminder that Section 1260H listings are not final the moment they're published — they can be, and are being, litigated, and a single district court order can suspend a Pentagon blacklist entry DoD-wide while the case proceeds. Companies relying on 1260H designations to screen subcontractors or joint-venture partners should track the docket in Alibaba's case, and in the parallel suit from WuXi AppTec, since a favorable ruling for either company could reshape how contracting officers apply the list going forward. Neither change is permanent: the CMMC suspension is a deviation pending further rulemaking, and the Alibaba waiver expires with the litigation. Contractors should treat both as current operative guidance, not settled law.
