Third-party cybersecurity assessment of defense industrial base could take 15 years