The pause on the next phase of the Cybersecurity Maturity Model Certification (CMMC) program has prompted major questions about how the government plans to verify the protection of sensitive data by defense contractors.