https://www.pivotpointsecurity.com/cmmc-2-0-scoping/