Do cloud based SPA's need to be fedramp moderate? Do on prem SPA's fall into CUI boundary? They don't store or transmit CUI just provide security services like patch management or device control.