outlined in the CMMC supplemental guide