OpenText Fortify

Connection methods

• CI/CD pipeline scan API
• SAST platform REST API
• Pull request decoration webhooks
• SARIF or CSV finding exports

Documentation topics

Review the following areas in OpenText Fortify admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

OpenText Fortify integrates with ComplAI to support Propel Ready Solutions's GRC program. Enterprise SAST for scalable application security testing programs. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Open code findings by severity
• Scan frequency per repository
• Developer fix rates
• Release gate pass/fail metrics
• Static code analysis metrics and configuration evidence
• Audit workflow metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in OpenText Fortify
• OpenText Fortify product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan OpenText Fortify integration scope

   Confirm which Static code analysis and Audit workflow capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Integrate SAST into CI/CD

   Enable pipeline scans for all production repositories with quality gates on critical/high findings.

3. Step 3

   Connect SAST platform API

   Pull scan results, fix rates, and release gate status from SonarQube, Checkmarx, Veracode, Snyk, or GitLab.

4. Step 4

   Map findings to SDLC controls

   Link secure coding requirements to ISO A.8.25–A.8.28 and store scan reports as control evidence.

5. Step 5

   Track developer remediation

   Monitor open finding age, false-positive rates, and release blocking events in ComplAI dashboards.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Secure development lifecycle evidence for ISO A.8.25–A.8.28
• Developer remediation metrics for DevSecOps maturity programs
• Release gate compliance for change management (A.8.32)

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting