Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, which I understand is FedRAMP compliant. Is FedRAMP something that applies to this new software (or company that develops it) that is being hosted in MS's Azure environment? Or only to Azure itself?
As someone relatively new to the cybersecurity world, I want to be sure I understand the scope of FedRAMP and how it affects our options going forward.