There's an idea tempting every defense contractor as they learn more about CMMC:
maybe I don't actually have any controlled unclassified information (CUI). It's
an attractive narrative. After all, contracting officers and prime contractors
are supposed to identify CUI in awards. So, maybe you've never received any CUI
in the first place and the hullabaloo surrounding DFARS 252.204-7012 and CMMC
doesn't apply to you?
As part of implementing CMMC, I've gone through the process of identifying CUI