DigiCert Lists Three Services in FedRAMP Marketplace, Pursues 20x Class C

DigiCert has entered the Federal Risk and Authorization Management Program (FedRAMP) Marketplace with an initial implementation status listing for DigiCert for Government. The listing covers Trust Lifecycle Manager, Software Trust Manager, and Private CA, all within the DigiCert ONE platform. The company is pursuing certification under FedRAMP 20x Class C, but the available source material makes clear that certification has not yet been achieved. For federal buyers, this is a market-access and security-assurance development—not evidence of completed authorization, an awarded contract, or an open solicitation.

FedRAMP is the U.S. government program for assessing and authorizing cloud services for federal use. Introduced in 2025, FedRAMP 20x emphasizes automated security validation, continuous monitoring, and measurable security outcomes. Class C is described in the source material as the most rigorous certification level currently available under the updated framework and is intended for services handling sensitive federal information, including Controlled Unclassified Information (CUI). DigiCert’s pursuit therefore signals an effort to meet a demanding assurance level, while the distinction between marketplace presence and completed certification remains central to procurement decisions.

The three listed services address separate digital-trust functions that may be relevant to agency security and modernization programs. Trust Lifecycle Manager helps organizations discover, manage, and automate public and private certificate lifecycles, including certificates issued by DigiCert and other certificate authorities; the stated objective includes reducing operational complexity and certificate-related outage risk. Software Trust Manager focuses on software authenticity and integrity through centralized code signing, key management, policy-based controls, and release visibility. Private CA enables organizations to establish and manage private certificate authorities for internal users, devices, applications, and workloads. Buyers should map each use case to the specific service scope and confirm applicable authorization status before acquisition or deployment.

DigiCert Chief Trust Officer Lakshmi Hanspal said: “Our entry into the FedRAMP Marketplace is an important step toward expanding access to our intelligent trust platform across the federal government. By pursuing FedRAMP 20x, we are embracing a modern approach to security assurance that aligns with the automation and continuous protection government agencies need.” The company says it will continue evaluating its certification over time, including whether to bring additional DigiCert ONE offerings into scope. This creates a watch item for agency acquisition, cybersecurity, and identity teams: track certification progress, scope changes, and the status of each service rather than treating the initial listing as final approval.

• Marketplace status: DigiCert for Government is listed with initial implementation status; the listing does not establish that FedRAMP authorization has been completed.
• Certification target: DigiCert is pursuing FedRAMP 20x Class C, described as the framework’s most rigorous currently available level for cloud services handling sensitive federal information, including CUI.
• Services in scope: Trust Lifecycle Manager, Software Trust Manager, and Private CA are listed within the DigiCert ONE platform.
• Certificate operations: Trust Lifecycle Manager is designed to automate discovery and management of public and private certificates, with the stated aim of lowering complexity and outage risk.
• Software assurance: Software Trust Manager includes centralized code signing, key management, policy-based controls, and release visibility for development and security teams.
• Private trust infrastructure: Private CA supports private certificate authorities for internal users, devices, applications, and workloads.
• Framework context: FedRAMP 20x, introduced in 2025, emphasizes automated validation, continuous monitoring, and measurable security outcomes.
• Acquisition action: Federal buyers and contractors should verify the current authorization status and exact service scope against their requirements before relying on the listing.
• Pipeline interpretation: The source reports no solicitation, contract opportunity, award value, or government funding; treat this as company certification and federal market-access news.
• Potential scope expansion: DigiCert says it will continue evaluating its certification, including whether additional DigiCert ONE offerings may be included over time.