CMMC Practice AM.3.036: Define procedures for the handling of CUI data.
CMMC CLARIFICATION (Ref CMMC – Appendix B)
Establish procedures for handling CUI. Procedures should include how to categorize data as CUI and how to provide and enforce access control for CUI. It also includes guidance on how to receive, transmit, store, and destroy CUI. The procedures should account for both physical and digital CUI.