“step two: identify all your contracts that could contain CUI”