DOD-approved vendor CITRIX hit by Iranian Hackers

Here's a question:  How did CITRIX get approved as a DOD cloud service provider when they do NOT have DMARC email quarantine/rejection protocols set up? Ergo, six to ten terabytes of confidential internal procurement and project management information slipped into Iranian hacker hands (see the CPO magazine article here). Interestingly, they were hacked on March 4, but the company was not aware of the hack until the FBI advised them on March 6th. Sweet Baby Moses in the bullrushes!