As an initial matter, the system security requirements that must be applied by all Federal agencies for the protection of FCI and CUI and that underlie CMMC are not new; some have been in existence ...