StateRAMP Moderate Category 3 compliance gap analysis: what auditors check vs what regulators find | Vulnox Blog