Can You Create CUI? CMMC Scope, ERP Systems, and Contractor Risk Explained

Submit any questions you would like answered on the podcast!In this episode of the CMMC Compliance Guide Podcast, we tackle one of the most misunderstood topics in CMMC compliance.Many contractors assume that if information is not marked as controlled unclassified information, then it is not CUI. But that assumption can lead to serious compliance risks.We break down how manufacturers and machine shops can actually create CUI while performing contract work, even if the original data was not clearly marked.We also cover how ERP systems factor into CMMC scope, when systems are considered in or out of scope, and how improper scoping decisions can create major compliance gaps.You will learn what derived CUI is, how it applies to things like CNC G code, and why simply removing identifying details from documents does not make them safe.We also explain who determines what qualifies as CUI, how scope can expand across your network, and what realistic cost and infrastructure decisions look like for small and mid sized contractors.If you are part of the defense supply chain, this episode will help you avoid one of the most common and costly misunderstandings in CMMC.