Typically, SaaS applications for functions like human resources and accounting do not fall under the CMMC Assessment Scope. This is because they usually do not handle CUI, provide security functions for the OSA’s environment, or store Security Protection Data. However, the OSA must ultimately determine whether the SaaS application interacts with CUI or SPD to decide its inclusion.