https://cmmcinfo.org/cmmc-faq/cui-and-fci/how-do-we-know-if-our-organization-handles-cui/