Matt Titcombe asks about the scoping guide and CRMA which aren't supposed to have CUI but could and are in scope out of 109 of 110 controls if you manage the risk of these assets.