Checkmarx SOW_8.14.24.docx
DOCX document 92 KB Posted
- Attached to
- Checkmarx Licenses
- Solicitation number
- OIT-393-2024-0870-RAW
About this file
This document is a Statement of Work (SOW) for the Checkmarx Static Code Analysis (CxSAST) solution. The SOW outlines the CMS requirement for 122 Checkmarx user licenses and 61 project licenses to scan Salesforce applications developed by 122 CMS developers. It also requires one Checkmarx server license, additional scanning engines to handle the scanning demands, an Auditor license to create custom queries, and an Integration license to integrate Checkmarx with CMS's existing development stack.
The related federal contract opportunity is a Request for Quotation (RFQ) for the Checkmarx licenses, to be awarded on a sole source basis to Technology Solutions Provider, Inc. under the Simplified Acquisition Procedures. The period of performance is September 15, 2024 - September 14, 2025, and the NAICS code is 511210. Quotes must be submitted by 11:00 am EST on September 10, 2024, and remain valid for 180 days. The award will be made to the responsible offeror whose quote is the Lowest Price Technically Acceptable (LPTA) to the government.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFQ.rev.docx | DOCX document | |
| RFQ.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Statement of Work Checkmarx August 14, 2024
Checkmarx Static Code Analysis (CxSAST) will allow CMS to scan Apex code as developers are creating it to identify and ultimately remediate security risks introduced by insecure code. Compared with other source analysis tools, Checkmarx is widely accepted by the Salesforce development team because it seamlessly fits into the existing software development life cycle and helps in quick implementation to meet CMS ever-evolving business needs. CMS has 122 developers writing Salesforce applications. In order to ensure that CMS has full coverage in identifying vulnerabilities produced by the Salesforce developers we will require 122 licenses of Checkmarx users. (Cx-VolUser-1YR- AllSupLangIncApex). Checkmarx provides a 2:1 ratio of users to projects at no additional cost. Projects are identified as a code base that is scanned at one time. CMS will require the 61 projects in order to scan all of the CMS Salesforce applications. (Cx-Project-1Yr-AllSupLangIncApex). Checkmarx requires each environment to be licensed for one server (Cx-Server-1YR- AllSupLangIncApex). In order to meet the scanning demands of CMS, multiple scanning engines will need to be run simultaneously. Checkmarx offers the ability to do this through the acquisition of additional scanning engines (Cx-Concurrent Scans). The creation of custom queries are required in order ensure a low false/true positive rate that is unique to the CMS environment. Checkmarx provides this capability through an Auditor license (Cx-Auditor-1YR- AllSupLangIncApex). In order to streamline the scanning/remediation process, CMS requires the ability to integrate the Checkmarx solution with their existing development stack. Checkmarx provides this capability through an integration license (Cx-Integration-1YR- AllLangIncApex) image1.png
File details come from the government source that posted it. Updated .