Black Duck Makes Inroads into FedRAMP Marketplace with Class C Certification Pursuit

Black Duck Enters the FedRAMP Marketplace

Black Duck®, renowned for its innovative solutions in application security, has announced a significant milestone in its journey towards enhancing government software security. The company’s Polaris™ Platform has officially entered the Federal Risk and Authorization Management Program (FedRAMP®) Marketplace, marking its initial implementation phase. This entry is crucial as Black Duck aims to achieve the coveted FedRAMP 20x Class C Certification.

Understanding FedRAMP 20x

Introduced in 2025, the updated FedRAMP standards modernize how the federal sector assesses cloud security solutions. Departing from the traditional reliance on static documentation, the 20x framework utilizes 46 Key Security Indicators that are validated through automated checks. This shift to a model of continuous monitoring emphasizes measurable outcomes, ensuring that security mechanisms are robust and adaptive to modern threats. Class C certification is specifically tailored for cloud services managing sensitive federal data, which includes Controlled Unclassified Information (CUI).

Black Duck’s Vision

Dipto Chakravarty, Chief Product Technology Officer at Black Duck, emphasizes the urgency for comprehensive security solutions that can keep pace with the rapid evolution of software development, particularly in federal entities. “The speed at which software is developed is accelerating due to AI, and federal agencies require security that can match that speed,” Chakravarty explains.

By officially entering the FedRAMP Marketplace, Black Duck is making significant strides toward introducing its Polaris Platform to the public sector. The dedication to obtaining the FedRAMP 20x certification reflects a commitment to a model founded on automation and continuous validation. This approach is also aligned with the needs of federal agencies to streamline complexity and swiftly address software vulnerabilities.

Features of the Polaris Platform

The Black Duck Polaris Platform offers a comprehensive solution for managing software risk. It empowers agencies to identify and address vulnerabilities in proprietary code, open-source components, containers, and cloud infrastructures. Utilizing Polaris enables agencies to accelerate secure software delivery, support continuous Authority to Operate (ATO), and acquire organization-wide visibility concerning software risk.

Moreover, in tandem with pursuing 20x Class C Certification, the platform will undergo independent assessments against the FedRAMP Rev5 Moderate baseline. This initiative is critical, as it will provide organizations vetting cloud services with detailed evidence for their evaluations, thereby facilitating certifications such as GovRAMP for state, local, and educational markets as well as DISA Impact Level 2 (IL2) necessary for the Department of War.

Collaboration for Certification

Black Duck is not journeying alone. The company is collaborating with stackArmor to navigate its path toward FedRAMP certification and has pledged to provide consistent progress updates on the FedRAMP Marketplace as the certification process unfolds. This partnership is aimed at ensuring that Black Duck’s progress is transparent and in alignment with industry standards.

Commitment to Secure Digital Transformation

The push for FedRAMP 20x by Black Duck underscores its unwavering commitment to secure digital transformation, especially in the public sector where vulnerability management is rapidly evolving. Notably, the Cybersecurity and Infrastructure Security Agency’s (CISA) recent Binding Operational Directive (BOD) 26-04 introduces a risk-based model for prioritizing remediation instead of traditional CVSS severity scores. This shift comes with stringent deadlines for the most critical vulnerabilities, sometimes as short as three days.

As federal agencies embark on modernization efforts, Black Duck offers a strategic solution for embedding security throughout the software development life cycle (SDLC). With its track record of serving thousands of organizations in industries such as aerospace, defense, automotive, semiconductor, and healthcare, Black Duck stands out as a leader, equipped with a legacy of over 20 years in human-verified vulnerability intelligence.

For more information about the Black Duck Polaris Platform and its security solutions tailored for the government sector, visit Black Duck's official website and explore their FedRAMP Marketplace listing.