PARAMUS, NJ — Checkmarx today announced that its Checkmarx One for Government application security platform has achieved FedRAMP Moderate Certification and is now listed in the FedRAMP Marketplace. The certification reflects growing federal demand for a comprehensive application security platform that enables agencies to secure software development at scale while meeting stringent government security requirements.
“In an AI-driven world where the velocity of software development is accelerating and the threat landscape is multiplying even faster, application security has never been more critical,” said Sandeep Johri, CEO of Checkmarx. “Federal agencies making long-term security investments need a platform that provides visibility, governance, and risk-based prioritization across the entire software lifecycle. Checkmarx One for Government provides the essential AppSec toolset in one platform, helping agencies strengthen security today while building a foundation for the future of software development. FedRAMP Certification means federal agencies can now access those capabilities with the compliance confidence their missions demand.”
“With more than 100 government agencies already using Checkmarx, Checkmarx offers an established platform, not a point solution,” said Kevin Hayes, Senior Director of Public Sector Sales. “This process gave us direct insight into the challenges federal development and security teams specifically face, including fragmented security tooling, accelerating software delivery cycles, and increasingly complex compliance requirements. Checkmarx One for Government was built to help agencies address those challenges with comprehensive testing and centralized risk management.”
FedRAMP Moderate Certification enables federal agencies to adopt Checkmarx One for Government through a streamlined procurement and security review process. The Moderate baseline supports the vast majority of civilian agency workloads, providing a trusted foundation for cloud-based application security programs. For organizations operating in highly-sensitive environments, Checkmarx also offers deployment options that support more stringent security requirements.
Unlike many FedRAMP-certified application security offerings that focus on a single testing capability, Checkmarx One for Government delivers an integrated platform for securing software throughout the development lifecycle. The platform combines Static Application Security Testing (SAST), Software Composition Analysis (SCA), Malicious Package Detection, Infrastructure as Code (IaC) Security, Container Security, and Application Security Posture Management (ASPM) within a unified environment.
At the center of the platform is Checkmarx ASPM, which provides a consolidated view of application risk across code, open-source dependencies, infrastructure, containers, and cloud environments. By correlating findings across security disciplines, ASPM helps federal teams prioritize the vulnerabilities that matter most, reduce remediation time, maintain continuous compliance, and strengthen security posture throughout the software lifecycle. This platform-wide visibility and risk intelligence enables agencies to move beyond isolated testing tools and adopt a more effective, operational approach to application security.
The certification marks another milestone in Checkmarx’s continued investment in helping organizations secure software in increasingly complex development environments.
For more information on Checkmarx’s public sector offerings, please visit the company’s website or the FedRAMP Marketplace.
About Checkmarx One for Government
Checkmarx delivers a FedRAMP Certified cloud-native AppSec platform purpose-built for federal agencies to empower secure, compliant development from the first line of code to cloud deployment. The platform enforces consistent policies, reduces tool sprawl, and provides full lifecycle risk visibility. With support for SAST, SCA, IaC, Container Security, Malicious Package Detection, and ASPM, Checkmarx One for Government helps agencies meet Zero Trust, NIST, and executive order mandates while streamlining AppSec operations across hybrid environments.
