CMMC Phase II Is Paused, But Contractors’ Data-Security Obligations Are Not