[FedRAMP Phishing Rule]: “Users are the last line of defense and should be tested.”

If you want to sell cloud-based software to the U.S. Government, you need to be FedRAMP authorized. This is what they state in their Program Overview: