NIST SP 800-171 requirements cover about 35% of the broader NIST SP 800-53 controls needed for FedRAMP compliance. CSPs who aim to offer services to government agencies must meet FedRAMP standards to get their Authority to Operate.