Many organizations begin their Cybersecurity Maturity Model Certification programs by opening a control spreadsheet and working line by line through NIST SP 800-171. That instinct is understandable.