CMMC officially goes into effect Nov. 10, but the Pentagon has three-year, "phased" implementation plan for the sweeping contractor cybersecurity requirements.