Do you have an accurate, up-to-date inventory of every internet-facing IP address, domain, and service (web apps, VPN, mail, RDP, etc.)?

This is the single most common reason a Plus scan turns up something the business didn't expect. If you don't know what's exposed, the assessor's scanner will find it for you, and finding it during the actual audit is a fail, not a heads-up.