At this time, it's uncertain whether non-defense industries will adopt CMMC. Currently, CMMC is only required for contractors bidding on defense contracts. But as cybersecurity becomes more important, it's possible that other industries will start using similar frameworks in the future.