A U.S.-based SaaS company wants to sell its cloud-hosted collaboration platform to multiple federal government agencies. During a compliance planning meeting, the security team is asked which authorization framework the company must satisfy before federal agencies can procure and use the cloud service. Which compliance standard applies to this scenario?