What should we do first if we’re starting from scratch?

Start with defining the CUI boundary and scope. Until that is clear, remediation and control implementation efforts risk being misapplied or duplicated.