What set of established security requirements MUST that cloud provider meet?

A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS clause 252.204-7012.

What set of established security requirements MUST that cloud provider meet?
A . FedRAMP Low
B . FedRAMP Moderate
C . FedRAMP High
D . FedRAMP Secure

Answer: B