CheckMarx_SOW_N6893618Q0115.pdf

UNCLASSIFIED 1

CheckMarx Statement of Work Prepared for Contracts Air 2.0

12 February 2018

Prepared by:

Tactical Mobility and Wireless Integration Lab Naval Air Warfare Center Weapons Division

1 Administration Circle China Lake, CA 93555

DISTRIBUTION STATEMENT D. Distribution authorized to Department of Defense and DOD contractors only;

Critical Technology and Operational Use, 12 Jan, 2016. Other requests for this document shall be referred to the Commander, Naval Air Warfare Center Weapons Division, (Code 41Q300D), 1900 Knox Rd., China Lake, CA 93555-6106.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents of the document.

UNCLASSIFIED 2

Table of Contents 1 Background

2 Scope

3 Requirements

4 Deliverables

UNCLASSIFIED 3

1 Background

The Naval Air Warfare Center Weapons Division (NAWCWD), China Lake requires the purchase of CheckMarx vulnerability scanning system. This is a commercial product that allows software teams to validate their code against different levels of susceptibility. This software is already used by the requesting team and some other DoD/DoN entities.

2 Scope

This requirement is for any applicable installers, databases, and Integrated Development Environment (IDE) plug-ins necessary for the product to function on a Zone D network or standalone machine. These tools must be able to be installed on the target machine without internet connection.

3 Requirements

The contractor shall provide the brand name Checkmarx software, or equal, meeting the following requirements:

• Source code vulnerability scanner targeting Android Java

• Install on Zone D connected or non-connected stand-alone machines

• Non internet updatable vulnerability database

• Plug-ins for all supported IDEs o The scanning shall be conducted within the IDE and shall not be conducted via a code repository tool

4 Deliverables

1. CheckMarx CxSAST 8.4.2.1032 or higher

2. CxViewer for all supported IDEs:

a. IntelliJ-8.42.0 or higher is a threshold