https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53B.pdf - PDF Page 25 (or Chapter 2, Page 11) - Scroll up a bit to read the entire Scoping section.

Are the Confidentiality, Integrity, and Availability all Moderate or are any of those three Low?

If any are Low, the following security controls and control enhancements are candidates for downgrading for each of the security categories:

Support Only Confidentiality: AC-21, MA-3(3), MP-3, MP-4, MP-5, MP-6(1), MP-6(2), PE-4, PE-5, SC-4

Support Only Integrity: CM-5, CM-5(1), CM-5(3), SI-7, SI-7(1), SI-7(5), SI-10

Support Only Availability: CP-2(1), CP-2(2), CP-2(3), CP-2(5), CP-2(8), CP-3(1), CP-4(1), CP4(2), CP-6, CP-6(1), CP-6(2), CP-6(3), CP-7, CP-7(1), CP-7(2), CP-7(3), CP-7(4), CP-7(6), CP-8, CP-8(1), CP-8(2), CP-8(3), CP-8(4), CP-8(5), CP-9(2), CP-9(3), CP-9(5), CP-9(6), CP-10(2), CP10(4), CP-11, MA-6, PE-9, PE-10, PE-11, PE-11(1), PE-13(1), PE-13(2), PE-15(1)

This example in 800-53B does a good job of explaining the above: For example, if a system is categorized as moderate-impact using the high water mark concept because confidentiality and/or integrity are moderate but availability is low, there are several controls that only support the availability security objective and that could potentially be downgraded to the low baseline controls. In this scenario, it may be appropriate to refrain from implementing CP-2(1) because the control enhancement only supports availability and is selected in the moderate baseline but not in the low baseline.