“Software companies must undergo a lengthy, multi-year process to obtain FedRAMP certification before they can sell to the U.S. federal government.”