It can be. Both frameworks expect organizations to know and manage their digital footprint and third-party dependencies, so unmanaged assets and undocumented vendor connections are gaps an auditor or regulator can reasonably flag.
FAQ
Attack Surface Discovery