Or in some cases, different (but overall worse) controls to meet FedRAMP requirements, and much less security monitoring or active testing than the commercial environment.