Defense and federal officials have been working on a new set of guidelines for basic cybersecurity controls that will become an important part of future IT contracts.