Vendors are waiting for the Defense Department to release more details, including the proposed acquisition rule, about how it will apply the new Cybersecurity Maturity Model Certification starting this year.