Software security in the federal space is moving faster than the processes built to govern it. AI is compressing development cycles, vulnerability deadlines are shrinking, and the old model of documenting controls in lengthy narratives is giving way to something more measurable.
Black Duck is meeting that shift head-on. Our Polaris™ Platform is now listed on the FedRAMP® Marketplace in the Initial Implementation phase as we pursue FedRAMP 20x Class C Certification.
This marks an important step toward bringing Polaris to the federal government. It also reflects our broader commitment to helping agencies eliminate legacy complexity and identify and remediate software risk at speed and at scale.
How FedRAMP 20x changes cloud security evaluation
Federal agencies carry an increasingly heavy software security burden. They manage risk across an expanding attack surface, often with tooling that wasn’t built for that breadth. Fragmented visibility makes it harder to meet mandates, pass audits, and deliver software with the speed modernization demands.
FedRAMP 20x, introduced in 2025, rethinks how cloud security is evaluated. Instead of leaning on written control descriptions, it measures security through 46 Key Security Indicators and puts continuous monitoring and demonstrable outcomes at the center.
Class C, the tier Black Duck is pursuing, applies to cloud services that handle sensitive federal information, including Controlled Unclassified Information (CUI).
For agencies, that means a certification process that reflects how modern software actually is built and secured: continuously, and with evidence rather than paperwork.
Polaris will be independently assessed against the FedRAMP Rev. 5 Moderate baseline, giving organizations that evaluate cloud services at the control level additional evidence for their review. The assessment also facilitates GovRAMP certification for the state, local, and education (SLED) market and supports DISA Impact Level 2 (IL2) authorization for the Department of War.
What Polaris brings to the public sector
Polaris gives agencies a single view of software risk across the full stack, including proprietary code, open source, containers, and cloud infrastructure. Teams can find and fix vulnerabilities before they reach production with Polaris.
The Polaris Platform is built to:
- Accelerate secure software delivery
- Support continuous ATO
- Gain agency-wide visibility into software risk
The clock is ticking on vulnerability response
The pressure on federal vulnerability management is intensifying. CISA’s Binding Operational Directive (BOD) 26-04 moves agencies away from CVSS severity scores toward a risk-based remediation model with deadlines as tight as three days for the most urgent issues.
That’s a fundamentally different operating rhythm, and it’s exactly where embedding security throughout the software development life cycle (SDLC) pays off.
Here’s how you can start preparing now.
- Evaluate Polaris against your current risk profile. Map its capabilities to the vulnerabilities you’re tracking across code, open source, containers, and cloud infrastructure.
- Identify where fragmented tooling creates blind spots. A unified platform can close gaps that point tools leave open.
- Plan for continuous ATO. Build the documentation and monitoring practices now that a platform will support later.
Black Duck is working with stackArmor throughout the certification process. We’ll share regular progress updates on the FedRAMP Marketplace as each milestone is reached.
