Hello. I have a broad question and would like some input / opinions. Our organization is a Defense Contractor. We have CUI. Nothing is segmented to allow filtration of the CUI (i.e. who sees it). Thus we have to consider all data as CUI. Another caveat to our scenario is we use MECM for device management. Many of the users / devices are remote only so they are difficult to get a good reading on what has been done to the devices since MECM needs physical access to get pivot reports.

We are currently going through voluntary audit using a C3PAO. This a huge gig obviously.

Does anyone have some experience to share or opinions on what you would do?