Defense Department documents show the biggest challenges are not with CMMC, but with the underlying NIST standards.