Is there a link to the actual order anywhere? For us FedRAMP folks, the exact order contents actually matter, rather than a journalistic regurgitation. I was hoping one of the links in the article pointed to a source, but they're all just links back to other WSJ pages.
Most corps will take the safer bet of not using them at all to prevent "accidental" miscompliance and more expensive audits. I'd bet if you need fedramp compliance you'll get forced out of their products generically.
It sounds like they still have not issued any sort of actual order. The "formal label" described in the article is that they sent a communication directly to Anthropic saying they're a supply chain risk.