CMMC is a legal minefield for both assessors and those being assessed.