DoD's review of the Cybersecurity Maturity Model Certification is ongoing, but officials want to address small business concerns about compliance costs.