There's an idea tempting every defense contractor as they learn more about CMMC: maybe I don't actually have any controlled unclassified information (CUI). It's an attractive narrative. After all, contracting officers and prime contractors are supposed to identify CUI in awards. So, maybe you've never received any CUI in the first place and the hullabaloo surrounding DFARS 252.204-7012 and CMMC doesn't apply to you? As part of implementing CMMC, I've gone through the process of identifying CUI