“The Department of Defense is shifting its cybersecurity strategy from a checklist-driven compliance model to a unified, holistic, risk-based approach.”