For an organization to properly secure data, at an affordable cost, the data needing to be secure needs to be identified as it flows through an organization. Within NIST SP 800-171 and CMMC, the data driving improved security requirements is Controlled Unclassified Information (CUI). An OSC cannot accurately or confidently defend full compliance to NIST SP 800-171 if they are not aware of where CUI is and isn’t. Beryllium’s CMMC advisors work with OSCs to understand where and when CUI comes into the organization, who handles it within the organization, and what methods are used to send CUI outside of the organization. Every OSC’s situation and business process is different. By having a clearly defined data flow, scope and control become far easier, while the costs of compliance are greatly reduced.