So far, I've left all systems that handle accounting and contracts out of my CMMC secured enclave scope with my argument being that FCI doesn't need to be restricted the same way as CUI.
Am I wrong?! Do I need to be prepared for COs to label anything and everything as CUI? Do I need GCCH seats for administrators/accounting?
Thanks!
[link] [comments]