Even for the government, the Defense Department's Cybersecurity Maturity Model Certification program is a complicated apparatus.