How does one determine what actually constitutes CUI? The customer sends us something that we design which has a final result of something that is CUI. Now we take that design and run it through some CAM software to generate the .gcode that is sent to the machines on our shop floor. Is that .gcode considered CUI? Assuming it is, how are we able to claim it is 'encrypted at rest' when the computers used for our CNC machines do no support encryption?

There are a lot of 'lines' that are blurry at best, and I am wondering how one decides which is the best way to tackle those.