Although the systems do not process or store CUI data, they are still in scope because they are providing protections to the network that does process or store CUI data. Therefore, their configurations must be reviewed to ensure they are functioning as expected.