Hello, I am helping a client get through CMMC level 2 compliance efforts and they got hit with a request from a military branch to now be compliant with IL5. I know CUI is IL4 and moving to IL5 now includes NSS, National security systems. The CMMC controls are a subset of 800-53 moderate baseline controls. What I am not sure is what framework I need to assess them on now, 800-53 high? Fedramp? (They are building there app in the cloud but told me it was only going to be accessible by the military and then have a separate instance for commercial, this maybe changing) getting little to no help from the COR and definitive info is hard to find online. Anyone have any experience with this that they would be willing to share? Thank you in advance!