Just wait until you have to comply with CMMC if you are a defense contractor.