No, NIST is the What, and CMMC is the How. They are both needed and play an integral role in the new cyber security mandate.