I think the OP is more interested if Unity is compliant with NIST 800-53 for simulation purposes. As far as the web player is concerned, because the execution of the code is conducted on the client system, it would normally be OK as long as the web server was FIPS 140 compliant in its implementation of HTTPS and the data was properly secured at rest. Also, like any system containing sensitive information, there must be proper controls in place to ensure non-authorized personnel are able to reach the site. Another mitigating control, having to do with plugin support would be that for reasons of traceability, the web player plugin itself should be hosted on a system which is limited in access to a comparable level as the content delivery host rather than allowing users to download it from another source.
In a closed environment, this would more than likely be OK. In an open environment, where systems can reach it from the outside, you may run into some issues, but ones that would be no different from any other web-based service. Inside the modules, you would absolutely have to to make sure that all information contained is limited only to the proper classification level and conforms to your agency’s compartmentalization guidelines. For example, a system which has only been cleared for containing FOUO/SBU must absolutely not have any Secret information on it, nor can it have read-up access to to a Secret or Top-Secret system. Inversely, if your simulation is cleared for TS usage, it must not have write-down into Secret or FOUO/SBU systems.
It’s not too complicated, but your ISSO should be able to provide you proper guidance, whether or not they can is another matter entirely. If your implementation is 800-53 compliant, to include the systems on which the application runs and the systems which host the application, you should be OK. If you design it and document it properly, an IATO should be pretty easy to get; if you implement it properly and maintain it properly, like any system, an ATO should be attainable.
If you are interested in multiplayer, or in this case, multiuser, very little really changes. The constraints are of course that inter-system communication must still meet your agency’s guidelines. More than likely, that would be using AES-256 encryption for the multi-player, but if the systems are not capable of performing at a usable pace with that encryption, a waive to use AES-128 will likely be possible. Across the public Internet though, multi-player would probably be nixed unless it was merely a public relations tool, in which case it would fall below even SBU/FOUO in the simulation or game and the hosting system would would be treated like any other federal web server for security requirements. In those cases, you will have to follow the Privacy Act for collecting user information if any PII is collected.
If you have any questions about these sorts of things, feel free to send me a PM. Also, it would help to know which agency is the intended user.