So im going through the controls and trying to identify and rationalize how we satisfy each requirement. Its pretty daunting. We are a new contracting company and have no current CUI. Part of me thinks to just segment my scope to a specific GCC high tenant and keep everything else how we sit today? Otherwise i have to scope it all it seems like.

What does it take for you to consider each section "satisfied"? Specific process and explanation for each and proper documentation incase of audits?