CMMC readiness should not start with a spreadsheet of controls. It should start with the data. For defense contractors ...