A SOC analyst at a systems integrator is onboarding a new client that operates an information system on behalf of a U.S. federal executive branch agency. The client's contract requires them to categorize the system per FIPS 199, implement NIST SP 800-53 controls, and produce continuous monitoring reports for the agency's authorizing official. Which compliance framework is this client's program built around?