According to the search results, a moderate level of system and network configuration is required for CUI. Additionally, DIB contractors must be CMMC Certified Level 3 by a C3PAO to handle CUI. The Cybersecurity Maturity Model Certification (CMMC) was established by the DoD to assess members of the DIB and ensure they have sufficient systems in place to protect CUI. The CMMC cybersecurity framework consists of 110 controls and is based largely on NIST 800-171. NIST SP 800-171 specifies 110 individual requirements across 14 families, and organizations with moderate exposure to CUI must implement all 110 requirements and conduct third-party assessments triennially.