The two rulemakings to implement the Defense Department’s Cybersecurity Maturity Model Certification program are a work in progress, according to DOD cyber chief David McKeown, who says the Pentagon is continuing to develop its policies in areas such as incentives and how contractors will be allowed to fill gaps.