The Pentagon is considering profit incentives and source selection criteria to get defense contractors to up their cybersecurity game before CMMC 2.0 becomes a reality.