When auditors come to review, do they ask you what your CUI is, or do we tell them? How would they know? If we are told some items are CUI, but believe they are not, do we get to make a case with the auditors? How does this part work?
[link] [comments]