An ESP is within scope if it meets the criteria for CUI Assets or Security Protection Assets, meaning it stores, processes, or transmits CUI or provides security functions within the OSA’s environment. The ESP’s services and responsibilities, as outlined in agreements like the Customer Responsibility Matrix (CRM), are assessed.