These activities occurs outside the main project track or they occur at the end of the project. They may last longer than a single iteration or they may be ran in parallel. This category can also include interactions with other services that are not agile themselves.
The sooner the long running activities can be identified the better. The Security Owner and the group should explore the possibility of these actions being needed in the Inception phase if at all possible.