On November 11th, Black Duck announced that its Polaris ™ platform has been included in the FedRAMP ® Federal Risk and Authorization Management Program (FRAM) Marketplace's Initial Implementation phase. The company is currently advancing towards the FedRAMP 20x Class C certification.
FedRAMP was launched in 2025 with the aim of modernizing the way the federal government assesses cloud security. Unlike approaches that rely primarily on written control descriptions, 20x measures security through 46 key security indicators ( Key Security Indicators ) combined with automated checks, emphasizing continuous monitoring and measurable results. Class C is aimed at cloud services that handle sensitive federal information, including controlled non-confidential information ( CUI ).
Black Duck Chief Product and Technology Officer Dipto Chakravarty stated: " AI is changing the speed at which software is written, and federal agencies need to have the security capabilities to keep up with this pace. Moving into FedRAMP Marketplace is an important step in bringing Polaris to the federal government. By advancing FedRAMP by 20x, we commit to adopting a model based on automation and continuous validation, which is also the principle that agencies need to use in order to eliminate legacy complexities and identify and fix software risks more quickly and on a larger scale."
Black Duck Polaris helps organizations manage software risks by identifying and fixing vulnerabilities in proprietary code, open-source code, containers, and cloud infrastructure. With Polaris, organizations can accelerate the delivery of security software, support continuous ATO, and achieve visibility of software risks across the entire organization.
In addition to promoting 20x Class C certification, Polaris will also undergo an independent assessment based on the FedRAMP Rev5 Moderate baseline. This will provide additional evidence for organizations evaluating cloud services by control level and will help them obtain GovRAMP certifications in state, local, and educational ( SLED ) markets, as well as the DISA Impact Level 2 ( IL2 ) certification for the Department of Defense.
Black Duck is collaborating with stackArmor to support their FedRAMP authentication process, and will regularly update progress on FedRAMP Marketplace throughout the authentication process.
Black Duck's promotion of FedRAMP by a factor of 20 also reflects its commitment to the digital transformation of public sector security, as federal vulnerability management is undergoing rapid changes. CISA's Binding Operational Directive ( BOD ) on April 26 replaced the CVSS severity scoring system with a risk-based model to prioritize repair efforts, with a repair deadline of just three days for the most urgent vulnerabilities. As organizations advance in modernization and reduce risks, Black Duck helps to embed security into the software development lifecycle ( SDLC ).
Resources:
- Learn about the Black Duck Polaris platform
- Access the list of Black Duck on FedRAMP Marketplace.
- Learn about Black Duck's government-oriented solutions
About Black Duck
Black Duck ® provides application security for the AI era. Our approach is "hybrid design." Deterministic analysis provides verifiable results and serves as a systematic record for governance; AI-driven reasoning prioritizes the identification of exploitable risks, while proxy-based repairs are completed at machine speed – allowing teams to deliver as quickly as they would write code AI, without having to inherit the accompanying risks. Black Duck is trusted by thousands of organizations in some of the world's most demanding industries, including aerospace, defense, automotive, semiconductors, and healthcare, and boasts over 20 years of manually verified vulnerability intelligence. For more information, please visit www.blackduck.com.
