The military cannot pay the salaries that are required to keep qualified people of certain professions/specialties. Surgeons and hackers, but also some other things too. so they must outsource to the private sector. But they certainly can require the contractor to use military provided/mandated security oversight. Mandate and verify good security practices, not tick checkboxes.