Announcements

Mercury Federal Partners with Sonatype to Strengthen Software Supply Chain Security

Mercury Federal is now an authorized reseller of Sonatype, the company behind Maven Central and creator of Nexus Repository, bringing open source risk protection and SBOM management to federal agencies, healthcare organizations, and defense missions.

With open source now comprising roughly 90% of modern applications, agencies and health systems face growing pressure to prove what's in their software — not just what it does. Executive Order 14028, CISA's SBOM minimum elements, and FDA premarket cybersecurity requirements for medical devices all now require an accurate, continuously updated software bill of materials.

Through this partnership, Mercury Federal customers gain:

• SBOM Manager — automated SBOM generation, validation, and continuous monitoring
• Nexus Repository & Firewall — blocking risky open source components before they reach production
• Nexus Lifecycle — continuous risk monitoring and policy enforcement across development
• Flexible deployment — SaaS, self-hosted, and air-gapped options for classified environments

"Sonatype gives us the visibility our federal and healthcare customers can't get anywhere else — knowing exactly what's in their software, not just trusting a vendor's word for it. As missions move faster and open source becomes the foundation of nearly everything we build, that visibility isn't optional anymore. This partnership lets us bring it to the organizations that need it most."

— Jonathan Bess, CEO, Mercury Federal

As an SDVOSB and HUBZone-certified company, Mercury Federal delivers this capability through fast, set-aside-eligible acquisition pathways.