The Pentagon is encouraging defense contractors to up their cybersecurity game, but new requirements could take until 2023 to show up in contracts.