Where this offering fits
Checkmarx SAST is a static code-security enquiry. Establish supported languages, application ownership and the findings the team must remediate. Keep the URL familiar while checking the current product packaging, since manufacturer naming and engine groupings can change.
Architecture and rollout decisions
Pilot a representative repository and review useful source context with developers. Define generated-code handling, exclusions and issue severity review. Connect findings to the team’s backlog and validate a correction through retesting. Repository permissions and processing arrangements should be approved before a wider rollout.
An evaluation scenario for this offering
Take a supported repository with an approved demonstration weakness and a developer assigned to fix it. Include one source area with deliberately limited assessment coverage and require that limitation to appear in the review. Follow the selected Checkmarx SAST workflow from scan configuration to issue assignment, code correction and retest. Have an application owner review a justified exception and its next review point. The expected outcome is a reproducible finding with clear source context and an intelligible release decision. It should not depend on enabling every default rule or treating a change in finding count as sufficient evidence of remediation.
Evidence to request for this scope
- Confirm current SAST engine and language support.
- Test developer assignment and remediation evidence.
- Document approved release thresholds and exceptions.