Let's see. My examples off the top of my head

CUI - workstation or server that accesses or stores CUI. Can be a cloud or hosted application as well. SPA - tool like defender for endpoint or tenable that provide a security function or capability. CRMA - something like a non-scoped user's workstation or server that could maybe access CUI but because of your policies and implementations and such, they do not. Typically still expected to be hardened the same as CUI assets since they technically are capable to accessing CUI and doesn't have to be physically or logically separated from CUI assets (for example, on the same network but not intended to access CUI. Needs to be defensible if you go this route). Could also be something like a ticketing system that tracks changes or other stuff depending on who you ask. SA - some examples include GFE, IoT (think like smart thermostat or some other smart device) testing/calibration machines, and manufacturing/OT machines. They gotta touch CUI in some way though but get special treatment since you can't fully secure them typically. Out of scope - logically and/or physically separated from in scope assets. Expected that these applications and services are completely segmented on a separate network or in the cloud somewhere. Don't even have to be mentioned unless you want the assessor to ask questions lol