Letter expressing concerns about the implications of the compliance requirements for protecting Controlled Unclassified Information (CUI) in non-Federal information systems.