Black Duck Enters FedRAMP Marketplace, Advances Toward FedRAMP 20x Class C Certification

Polaris™ Platform listed in the Initial Implementation phase as Black Duck pursues certification under the modernized FedRAMP framework

BURLINGTON, Mass., Nov. 11, 2026 /PRNewswire/ -- Black Duck^®, the leader in application security for the AI era, today announced that its Polaris™ Platform is now listed on the Federal Risk and Authorization Management Program (FedRAMP®) Marketplace in the Initial Implementation phase as the company pursues FedRAMP 20x Class C Certification.

Introduced in 2025, FedRAMP 20x modernizes how the federal government evaluates cloud security. Rather than relying primarily on written control narratives, 20x measures security through 46 Key Security Indicators validated with automated checks, emphasizing continuous monitoring and measurable outcomes. Class C is designed for cloud services that handle sensitive federal information, including Controlled Unclassified Information (CUI).

"AI is changing how fast software gets written, and federal agencies need security that keeps pace," said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. "Entering the FedRAMP Marketplace is an important step toward bringing Polaris to the federal government. By pursuing FedRAMP 20x, we're committing to a model built on automation and continuous validation, the same principles agencies need to eliminate legacy complexity and identify and remediate software risk at speed and at scale."

The Black Duck Polaris Platform helps agencies manage software risk by identifying and remediating vulnerabilities across proprietary code, open source, containers, and cloud infrastructure. With Polaris, agencies can accelerate secure software delivery, support continuous ATO, and gain agency-wide visibility into software risk.

In addition to pursuing 20x Class C Certification, Polaris will be independently assessed against the FedRAMP Rev5 Moderate baseline, giving organizations that evaluate cloud services at the control level additional evidence for their review, facilitating GovRAMP certification for the state, local and education (SLED) market as well as a DISA Impact Level 2 (IL2) for the Department of War.

Black Duck is working with stackArmor to support its path to FedRAMP Certification and will share regular progress updates on the FedRAMP Marketplace as certification advances.

Black Duck's pursuit of FedRAMP 20x underscores its commitment to secure digital transformation across the public sector as federal vulnerability management changes quickly. CISA's Binding Operational Directive (BOD) 26-04 replaces CVSS severity scores with a risk-based model for prioritizing remediation, with deadlines as short as three days for the most urgent vulnerabilities. As agencies modernize and reduce risk, Black Duck helps embed security throughout the software development life cycle (SDLC).

Resources:

Learn more about the Black Duck Polaris Platform

Visit the Black Duck listing on the FedRAMP Marketplace

Explore Black Duck solutions for government

About Black Duck

Black Duck® is application security for the AI era. Our approach is hybrid by design. Deterministic analysis delivers verifiable results and serves as the system of record for governance, while AI-powered reasoning prioritizes what's exploitable and agentic remediation fixes it at machine speed — so your team ships as fast as AI writes code, without inheriting the risk that comes with it. Trusted by thousands of organizations in many of the world's most demanding industries, including aerospace, defense, automotive, semiconductor, and healthcare, and backed by more than 20 years of human-verified vulnerability intelligence. Learn more at www.blackduck.com.

SOURCE Black Duck Software