“The FedRAMP security model was subsequently adopted by regulated commercial industries like healthcare and financial services.”