"The CMMC program is just a certification program on top of the security controls that are still required and will be required," said Eric Crusius.

© U.S. Navy/Rick Naystatt

The CMMC review could lead to "everything from an overhaul, to small tweaks here and there,” DoD CIO Kirsten Davies said after the review team's first meeting.

© Amelia Brust/Federal News Network