DigiCert enters FedRAMP Marketplace in certification push

DigiCert has entered the FedRAMP Marketplace with initial implementation status, becoming the first in its sector to pursue certification under the modernised FedRAMP 20x framework.

The effort centres on Class C, which DigiCert described as the most rigorous certification level currently available under FedRAMP 20x for cloud services that handle sensitive federal information, including Controlled Unclassified Information.

FedRAMP is the US government programme for assessing and authorising cloud services for federal use. The updated 20x framework, introduced in 2025, places greater emphasis on automated security validation, continuous monitoring and measurable security outcomes.

DigiCert's marketplace listing covers three services within its DigiCert ONE platform: Trust Lifecycle Manager, Software Trust Manager and Private CA.

Trust Lifecycle Manager is designed to help organisations discover, manage and automate the lifecycle of public and private certificates issued by DigiCert and other certificate authorities. The service is intended to reduce operational complexity and lower the risk of certificate-related outages.

Software Trust Manager is aimed at development and security teams and focuses on software authenticity and integrity. DigiCert said it includes centralised code signing, key management, policy-based controls and release visibility.

Private CA is designed to let organisations establish and manage private certificate authorities for internal users, devices, applications and workloads.

Federal focus

The FedRAMP listing gives DigiCert a route to offer these services to US federal agencies through a recognised government security framework. Class C is intended for services that handle more sensitive categories of federal information, placing the company's certification effort within one of the stricter parts of the current model.

Lakshmi Hanspal, Chief Trust Officer at DigiCert, said federal agencies face growing complexity in securing digital identities, applications and communications.

Hanspal added: "Our entry into the FedRAMP Marketplace is an important step toward expanding access to our intelligent trust platform across the federal government. By pursuing FedRAMP 20x, we are embracing a modern approach to security assurance that aligns with the automation and continuous protection government agencies need."

Certification path

DigiCert plans to continue evaluating its FedRAMP certification over time, including whether to bring additional DigiCert ONE offerings into scope. This suggests the current listing may be part of a broader effort to expand the company's presence in government security and identity infrastructure.

The company operates in digital trust, including public key infrastructure, certificate lifecycle management and related security services. Its case for federal relevance rests on the need for agencies to secure digital identities, software and communications as government systems become more distributed and more reliant on cloud-based tools.

FedRAMP 20x marks a shift in how cloud security reviews are structured. Rather than relying only on point-in-time checks, the framework is intended to support more continuous assurance through automation and ongoing validation while maintaining high security standards for government buyers.

For suppliers, entry into the FedRAMP Marketplace can be a notable step because federal agencies often use the programme as a benchmark when assessing cloud services. For companies in certificate management and software trust, the framework also offers a route into a segment where compliance and audit requirements carry particular weight.

DigiCert said its current listing is for DigiCert for Government and applies to the three named services within DigiCert ONE. It will continue to assess additional offerings as the certification process progresses.