"Federal executive branch agencies must ensure their non-.gov or .mil domains are on the list."
Also on this page, there is an "out of scope" list which only includes 4 things: SaaS, cloud resources, SNS sites, and code repos. I take the govt at its word--it has never lied before--so naturally covert ops must be "in-scope".
