Before you can protect Controlled Unclassified Information (CUI), you need to know where it is. Here is a practical way to find it.

CUI comes through the contract

DFARS 252.204-7012 defines the information it protects ("covered defense information") two ways:

Information marked or otherwise identified in the contract and provided to you by or on behalf of DoD- Information collected, developed, received, transmitted, used or stored by you or on your behalf in support of performing the contractSo CUI is not only what your customer sends you. It is also what you create from it. The clause lists examples of technical information such as engineering drawings, specifications, process sheets, manuals and technical reports.…