When should it be applied to contractors handling CUI?
As in which types of CUI Specified require adherence to one or more requirement from 172?
I can’t find any, the NIST people can’t answer the question… to me 172 seems to be a useless document for CUI.
The question could also be stated as: “for which types of CUI handling does CMMC set Level 3? (Or level 5 in version 1)
[link] [comments]