I work in compliance at a manufacturer that recently started defense work. We are a subcontractor (I’m sure many tiers down the chain) with no direct contracts with the government. We are trying to understand what information that we receive is actually CUI. Based on the description of CUI we believe at least some of what we are sent could be CUI. But nothing we receive has any CUI markings, we are never informed what info is CUI from our customers, and when we asked directly the Buyer in Procurement and Engineer from that company did not know the answer.
Does the CUI you receive always include CUI markings, or are you informed in some other way what the CUI is? Thanks!