Selling to US federal agencies requires FedRAMP authorization, one of the most expensive and time-consuming compliance programs. StateRAMP covers state and local government. CMMC is required for Department of Defense contractors handling controlled unclassified information (CUI). NIST 800-53 provides the control framework underlying FedRAMP. The government market is lucrative but the compliance barrier to entry is high -- FedRAMP authorization can cost $500K+ and take 12-18 months.