This control serves as a high-level directive to ensure that all Controlled Unclassified Information (CUI) is protected from unauthorized access or disclosure—regardless of where it resides or how it is handled.
Read the full blog breakdown of 3.13.16