Which of the following BEST describes a government-wide standard for security Assessment and Authorization (A&A) and continuous monitoring for cloud products, which is mandatory for federal agencies…

TCSEC (Trusted Computer System Evaluation Criteria) is an outdated standard from the 1980s, superseded by Common Criteria, and is not specifically for cloud products or mandatory for federal agencies today.

FITARA (Federal Information Technology Acquisition Reform Act) focuses on improving how the government acquires and manages IT, but it is not a standard for security A&A and continuous monitoring of cloud products.

FedRAMP (Federal Risk and Authorization Management Program) is explicitly designed as a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services, making it mandatory for federal agencies and Cloud Service Providers (CSPs). This streamlines the process and ensures consistent security standards across government cloud adoption.

NIST (National Institute of Standards and Technology) develops many security standards and guidelines (like SP 800-53), but NIST itself is an organization, not the specific program described for cloud A&A and continuous monitoring. FedRAMP heavily leverages NIST guidelines.