The Federal Risk and Authorization Management Program has announced that cloud service providers that maintain federal information are covered by a binding operational directive issued by the Cybersecurity and Infrastructure Security Agency.