This shouldn't really be a thing. If their staff couldn't answer, then they aren't fimilar with
FedRAMP. This is something I've dealt with when it comes to the cloud hosted apps I'm in charge of. The specific agency I was working with was concerned that the security level of AWS wasn't high enough so AWS went through the hoops of getting FedRAMP certified. I think they go up to level 4 or 5 (which is pretty high).
Granted, the stuff I was doing wasn't all that super secret when it comes to security. Mostly email and apps that allow the field guys to do their job, but it's still important for security considerations.
Also, SO many people that are technically IT in the government don't know squat. It's shocking how little they know. It's a ton of lifers that haven't kept up with modern technology so learning anything new isn't something a lot of them are willing to do.
I can tell you that having some rogue email server is not out of the realm of possibility. Some random staffer probably set it up and didn't think anything of it. Which is why that stuff is "supposed" to be heavily regulated.