{"id":"FR2514624801","name":"Checkmarx One for Government (CXG)","provider":"Checkmarx","providerSlug":"checkmarx","status":"FedRAMP Authorized","impact":"Moderate","authType":"Agency","authDate":"2026-06-12","serviceModel":["SaaS"],"deployment":"Government Community Cloud","businessFunctions":["Cybersecurity & Risk Management"],"assessor":"Schellman Compliance, LLC","assessorId":"136571","smallBusiness":true,"website":"https://checkmarx.com/product/application-security-platform/","description":"Checkmarx One for Government (CXG) is a cutting-edge, cloud-native application security platform designed specifically for U.S. government agencies. Hosted in AWS GovCloud, CXG provides a secure, single-tenant environment that supports the most stringent compliance standards, enabling government entities to safely develop, deploy, and monitor applications in a highly secure manner.\n\nCXG offers a comprehensive suite of security modules, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Application Security Posture Management (ASPM). Additionally, CXG provides advanced add-ons for Malicious Package Detection, Container Security, and Infrastructure as Code (IaC) Security, all of which enable government agencies to secure applications from code to cloud and across the entire software development lifecycle (SDLC).\n\nSeamlessly integrating into developer workflows through IDE plugins (such as VSCode), CLI, API, and a web-based UI, CXG empowers developers to identify and fix vulnerabilities early in the SDLC. The platform provides actionable remediation guidance and risk-based prioritization, ensuring that vulnerabilities are addressed before they can impact mission-critical systems.\n\nCXG continuously scans proprietary code, open-source dependencies, containers, and IaC templates using Checkmarx Threat Intelligence to proactively detect exploitable risks. Its developer-first experience allows secure software development without disruption, and its compliance features ensure alignment with industry standard benchmarks for security and risk management. Hosted in AWS GovCloud and built to meet the highest U.S. government security standards, CXG automates security across DevSecOps pipelines.\n\nCXG also ensures continuous monitoring of security controls, providing real-time insights into the security posture of your applications and infrastructure. It is purpose-built to meet the unique security and compliance needs of U.S. government agencies, enabling a secure and resilient software development process in today’s complex cybersecurity landscape.\n ","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/Checkmarx%20Logo.png","inMarketplace":true,"agencies":["22-005-11"],"reuseCount":0,"leverages":["AGENCYAMAZONEW","F1603047866","FR2131856836"],"leveragedBy":[],"timeline":[{"date":"2025-06-19","to":"FedRAMP Ready","certType":"Rev5"},{"date":"2025-12-17","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2026-04-24","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2026-06-12","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Schellman Compliance, LLC"},"sponsor":"22-005-11","trustCenterCheck":null}