Very thoughtful explanation of why we may choose mandates, but there is also the carrot approach. DOD is moving forward with a highly bureaucratic framework called CMMC that fails to provide direct inspection of the systems the DIB uses to managing their weapon systems programs. This is a bad idea, and CISQ should weigh in.