Authority
Section 2 of Executive Order 14275, Restoring Common Sense to Federal Procurement; Section 4(a) of Executive Order 14265, Modernizing Defense Acquisitions and Spurring Innovation in the Defense Industrial Base; Office of Management and Budget Memorandum M-25-26, Overhauling the Federal Acquisition Regulation
Summary
This deviation revises and supersedes Class Deviation 2026-O0025, Revision 1 issued on 2026-06-29. It implements revised Defense Federal Acquisition Regulation Supplement (DFARS) Part 240 and new DFARS Procedures, Guidance, and Information (PGI) 240 under the Revolutionary Federal Acquisition Regulation (FAR) Overhaul. Contracting officers must not apply the Chinese military company or covered lobbyist definitions to Alibaba Group Holding Limited and Alibaba Group (U.S.) Inc. based on their 1260H listing, and must remove or revise Cybersecurity Maturity Model Certification (CMMC) requirements per a court order and Department of War Chief Information Officer guidance.
Contracting Officer Actions
1
Effective immediately, do not apply the definition of Chinese military company or covered lobbyist at DFARS subpart 240.70 to Alibaba Group Holding Limited and Alibaba Group (U.S.) Inc. based on their inclusion on the 1260H list.
2
For all other purposes, treat Alibaba Group Holding Limited and Alibaba Group (U.S.) Inc. as a Chinese military company as published at 91 FR 35189.
3
Collaborate with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts.
4
Issue solicitation amendments to remove suspended CMMC Phase 2 requirements as soon as practicable.
5
For existing contracts containing CMMC Phase 2 requirements, remove them via modification prior to the next option exercise or next scheduled administrative modification.
6
Use the revised FAR Part 40 from the Revolutionary FAR Overhaul (RFO) web page in lieu of the codified text at 48 CFR chapter 1.
7
Use the attached revised DFARS Part 240, Information Security and Supply Chain Security.
8
Use the attached new DFARS PGI 240, Information Security and Supply Chain Security.
Alibaba court order scope
The court order in Alibaba Group Holding Limited, et al v U.S. Department of Defense, et al (case no. 26-cv-6227-EKL) temporarily waives the 10 U.S.C. 4663 prohibition for Alibaba only. The waiver applies until the court resolves the motion for a temporary restraining order and preliminary injunction or until 60 days after the court holds a hearing, whichever comes first.
CMMC suspension scope
The Department of War Chief Information Officer memorandum dated 2026-07-13 suspends the November 2026 CMMC Phase 2 transition. Requiring activities may include CMMC Level 1 (Self) or Level 2 (Self) assessments. Baseline compliance with National Institute of Standards and Technology Special Publication (NIST SP) 800-171 Rev 2 remains required under DFARS 252.204-7012.
Deviation duration
This deviation remains in effect until rescinded or incorporated into the FAR, DFARS and DFARS PGI.
Inquiries
Direct questions to osd.pentagon.ousd-a-s.mbx.dfars@mail.mil.
Affected Provisions and Clauses
52.240-90
CLAUSE
Modify clause 52.240-90
MODIFIED
52.240-91
CLAUSE
Modify clause 52.240-91
MODIFIED
252.225-7964
CLAUSE
Add clause 252.225-7964
MODIFIED
252.227-7989
CLAUSE
Modify clause 252.227-7989
MODIFIED
252.240-7007
CLAUSE
Add clause 252.240-7007
MODIFIED
252.240-7992
CLAUSE
Add clause 252.240-7992
MODIFIED
252.240-7993
CLAUSE
Add clause 252.240-7993
MODIFIED
252.240-7994
CLAUSE
Add clause 252.240-7994
MODIFIED
252.240-7995
CLAUSE
Add clause 252.240-7995
MODIFIED
252.240-7996
CLAUSE
Add clause 252.240-7996
MODIFIED
252.240-7997
CLAUSE
Add clause 252.240-7997
MODIFIED
252.240-7998
CLAUSE
Add clause 252.240-7998
MODIFIED
252.240-7999
CLAUSE
Add clause 252.240-7999
MODIFIED