The ultimate arbiter of whether a cloud service gets used isn't FedRAMP, it's the Agency Authorizing Official. FedRAMP just makes much of the work reusable. Wit

The ultimate arbiter of whether a cloud service gets used isn't FedRAMP, it's the Agency Authorizing Official. FedRAMP just makes much of the work reusable. With GCP, you can build something that obeys and uses DNSSEC without needing google.com to participate in DNSSEC. Google Workspace is a good point though. I know there are many users of it in government... maybe some AOs are fine signing off on it even without the needed security controls, which is an option they have in their discretion with and without FedRAMP.