As the title says, depending on the project our company may not just receive but also create CUI. I've been looking for guidance on how this process should work but have not found much. This document says this, but does not give any further information:

Anyone who creates information that is considered CUI is responsible for protecting and correctly handling it.

Any guidance or further information would be appreciated!