Software Quality and Security Standards Compliance

Ensure your software complies with the standards critical to customers and regulators

Ready to get started?

If your organization manages payments, handles sensitive customer or patient data, or operates in a regulated market, you may need to demonstrate compliance with specific standards to maintain customer trust and avoid legal or regulatory penalties.

View laws and regulations View standards, policies, and guidelines

Build compliance into your SDLC

Synopsys tools and services can integrate software testing into development workflows, focus analyses and remediation on compliance objectives, and report against specific software standards.

Achieve compliance with help from Synopsys

Laws and regulations

Laws and regulations are the system of rules that a country or community recognizes as regulating the actions of its members and that it may enforce with penalties.

In the U.S., Congress passes bills that the president then signs into law. Once a law is in place, the Office of Management and Budget (OMB) translates it into policy for federal agencies to implement and comply with.

Synopsys tools, services, and eLearning can help support your compliance goals associated with laws and regulations such as those listed here related to software quality, security, safety, privacy, and data protection.

Industry	Law or regulation
Automotive	UNECE World Forum for Harmonization of Vehicle Regulations (WP 29) Resources► View the regulation
Financial services	Gramm-Leach-Bliley Act (GLBA) Resources► BSIMM compliance and policy View the law
Healthcare	European Union (EU) medical devices regulation (MDR) 2017/745 Resources► View the regulation
	Federal Food, Drug, and Cosmetic (FD&C) Act Section 510(k) clearance for U.S. medical devices Resources► Software Security in Healthcare [datasheet] Establishing Secure Software Development Practices in Accordance with FDA Guidance [white paper] Secure Development for Healthcare [eLearning course] View the law
	Health Information Technology for Economic and Clinical Health (HITECH) Act Resources► Software Security in Healthcare [datasheet] Secure Development for Healthcare [eLearning course] View the law
	Health Insurance Portability and Accountability Act (HIPAA) Resources► What is HIPAA? Software Security in Healthcare [datasheet] BSIMM compliance and policy Secure Development for Healthcare [eLearning course] View the law
Multiple	California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) Resources► CCPA [eLearning course] View the regulations
	Federal Information Security Management Act and Federal Information Security Modernization Act (FISMA) Resources► View the law
	General Data Protection Regulation (GDPR) Resources► What is GDPR? GDPR Readiness [datasheet] GDPR and Open Source Security Guide [eBook] Securing your code: GDPR best practices for application security [blog post] BSIMM compliance and policy Intro to GDPR [eLearning course] GDPR for Developers and Architects [eLearning course] GDPR for Development and Project Managers [eLearning course] GDPR for Upper Management [eLearning course] View the regulation
	Sarbanes-Oxley (SOX) Act Resources► View the law
Public sector	Federal Risk and Authorization Management Program (FedRAMP) Authorization Act Resources► What is FedRAMP? Satisfying FedRAMP AppSec Requirements With Synopsys Solutions [datasheet] View the law

Standards, policies, and guidelines

Policies in the U.S. government are created by OMB or other agencies in response to laws and executive orders to create implementation guidance for government or internal agencies. This guidance can reference relevant standards and National Institute of Standards and Technology (NIST) special publications (SPs).

Guidelines provide direction on how to comply with and implement laws, regulations, and policies.

Standards provide the basis for demonstrating compliance with laws, policies, and regulatory guidelines.

Synopsys tools, services, and eLearning help enable compliance with standards, policies, and guidelines such as those shown below related to software quality, security, safety, privacy, and data protection.

Issues by industry recognized priority lists (PCI DSS 2018)

Sample Synopsys report for PCI DSS showing issues by industry-recognized priority lists

Print table

This solution maps to a specific requirement for this standard
This solution supports a general requirement for building security into the SDLC that the standard recommends

Industry
Standard, policy, or guidelines

Coverity static analysis
Black Duck composition analysis
Seeker interative analysis
Defensics protocol fuzz testing
WhiteHat dynamic analysis
Services
eLearning

Aerospace and defense	Cybersecurity Maturity Model Certification (CMMC) data protection controls (89 CWEs and numerous CVEs) Resources► View the controls
Aerospace and defense	Defense Information Systems Agency security technical implementation guides (DISA-STIG) Resources► Coverity Static Analysis Support for DISA-STIG [datasheet] View the guides
Aerospace and defense	DO-178C software considerations in airborne systems and equipment certification standards Resources► Deliver DO-178C Compliant Software on Budget and on Schedule [white paper] Making the skies safe and secure with DO-178C compliance [blog post] View the standards document
Aerospace and defense Automotive	AUTOSAR Adaptive Platform guidelines for the use of the C++14 language in critical and safety-related systems Resources► Coverity Support for AUTOSAR Coding Standards [datasheet] MISRA: Ensuring software safety and security from the start [blog post] Synopsys involvement with AUTOSAR View the standards
Aerospace and defense Automotive	ISO 26262 functional safety standard for road vehicles Resources► What is ISO 26262? Meeting ISO 26262 Guidelines With the Synopsys Software Integrity Portfolio [white paper] Introduction to Automotive Security [eLearning course] Synopsys involvement with ISO View the standard
Aerospace and defense Automotive	MISRA C and C++ coding standards Resources► What is MISRA? Coverity Support for MISRA Coding Standards [datasheet] MISRA: Ensuring software safety and security from the start [blog post] MISRA–AUTOSAR and the Future of the Connected Car [article] Synopsys involvement with MISRA View the standards
Automotive	ISO/CD 24089 software update engineering standard for road vehicles Resources► Synopsys involvement with ISO View the standard
Automotive	ISO/SAE 21434 cyber security engineering standard for road vehicles Resources► Secure Automotive Software Development in the Age of ISO/SAE 21434 [webinar] Are you ready for ISO SAE 21434 cybersecurity of road vehicles? [blog post] Synopsys involvement with ISO View the standard
Automotive	TR 68 – 3 cyber security principles and assessment framework for autonomous vehicles Resources► View the technical reference
Energy	NERC CIP reliability standards Resources► NERC CIP Compliance [datasheet] View the standards
Financial services	Monetary Authority of Singapore (MAS) guidelines on technology risk management practices Resources► View the guidelines
Financial services	Payment Card Industry Data Security Standard (PCI DSS) Resources► What is PCI DSS? Coverity Support for PCI DSS [datasheet] Seeker and PCI DSS Compliance [eBook] PCI DSS compliance isn’t security, but security can boost compliance [blog post] PCI DSS Security [eLearning course] Secure Development for Financial Services [eLearning course] BSIMM compliance and policy View the standard
Healthcare	AAMI TIR57 principles for medical device security risk management Resources► AAMI TIR57 recognized by the FDA as a foundational cybersecurity standard for medical devices [blog post] View the technical information report
Healthcare	ANSI/CAN/UL 2900-2-3 particular requirements for security and life safety signaling systems Resources► What is UL 2900? Synopsys and UL View the requirements
Healthcare	FDA premarket notification 510(k) Resources► Establishing Secure Software Development Practices in Accordance with FDA Guidance [white paper] Software Security in Healthcare [datasheet] Complex but helpful: Negotiating FDA guidance to build a cybersecurity program [blog post] Secure Development for Healthcare [eLearning course] FDA Content of Premarket Submissions for Management of Cyber Security in Medical Devices [FDA guidance document] View the notification
Healthcare	IEC 62304 software life cycle processes standard for medical device software Resources► Synopsys involvement with IEC View the standard
Healthcare	UL 2900-2-1 particular requirements for network-connectable components of healthcare and wellness systems Resources► What is UL 2900? Treating security like safety: What the FDA’s recognition of UL 2900-2-1:2018 means for developers [blog post] How to help your medical devices meet the UL (and FDA) standard [blog post] FDA adopts UL 2900-2-1, improves cyber security of connected medical devices [blog post] Synopsys and UL View the requirements
Multiple	ANSI/CAN/UL 2900-1 general requirements Resources► What is UL 2900? Synopsys and UL View the requirements
Multiple	ANSI/ISA/IEC 62443 standards for control system components Resources► How to protect our critical infrastructure [blog post] Software testing included in final ISA/IEC 62443-4-1 [blog post] Synopsys involvement with ISA View the standards
Multiple	CWE top 25 most dangerous software weaknesses Resources► Coverity Support for the CWE Top 25 [datasheet] CISO’s Guide to Sensitive Data Protection [white paper] MITRE releases 2020 CWE Top 25 most dangerous software weaknesses [blog post] What are the different types of security vulnerabilities? [blog post] Synopsys involvement with CWE View the list
Multiple	Federal Information Processing Standards (FIPS) publications 140-2 and 140-3 security requirements for cryptographic modules Resources► Coverity: Detection of encryption algorithms used (FIPS 140-2 compliance) [article] ROCA: Cryptographic flaws in BitLocker, Secure Boot, and millions of smartcards [blog post] Software Security Requirements [eLearning course] View the FIPS 140-2 publication View the FIPS 140-3 publication
Multiple	ISACA Control Objectives for Information and Related Technologies (COBIT) framework Resources► View the framework
Multiple	ISO/IEC 14882 C++ programming languages standard Resources► Synopsys involvement with ISO View the standard
Multiple	ISO/IEC 5055 automated source code quality measures for IT software and software quality measurement (CISQ Automated Source Code Quality Measures) Resources► Why automation is critical for your software development [blog post] Synopsys involvement with CISQ View the standard
Multiple	ISO/IEC 5230 OpenChain specification for IT Resources► Synopsys involvement with OpenChain View the standard
Multiple	ISO/IEC TR 24772 guidance to avoiding vulnerabilities in programming languages Resources► Synopsys involvement with ISO View the standard
Multiple	ISO/IEC TS 17961 C secure coding rules standard Resources► Coverity Support for ISO/IEC TS 17961 [datasheet] Synopsys involvement with ISO View the standard
Multiple	ISO/IEC/IEEE 15026 systems and software assurance standard Resources► Synopsys involvement with ISO View the standard
Multiple	ITU-T X.1520 recommendation on the use of common vulnerabilities and exposures (CVE) Resources► Synopsys CyRC named a CVE Numbering Authority [blog post] Synopsys involvement with CVE View the recommendation
Multiple	ITU-T X.1524 recommendation on the use of common weakness enumeration (CWE) Resources► Coverity Coverage for Common Weakness Enumeration (CWE) Synopsys involvement with CWE View the recommendation
Multiple	ITU-T X.1544 recommendation on the use of common attack pattern enumeration and classification (CAPEC) Resources► Synopsys involvement with CAPEC View the recommendation
Multiple	NIST SP 800-53 security and privacy controls for information systems and organizations Resources► Synopsys involvement with NIST View the guidelines
Multiple	OWASP Application Security Verification Standard (ASVS) Resources► OWASP Top Ten [eLearning course] Synopsys involvement with OWASP View the standard
Multiple	OWASP Mobile Top 10 web application security risks Resources► Coverity Support for OWASP Mobile Top 10 [datasheet] Synopsys involvement with OWASP View the list
Multiple	OWASP Top 10 web application security risks Resources► What is the OWASP Top 10? Coverity Support for OWASP Top 10 [datasheet] How to Create Your Own OWASP Top 10 Security Vulnerability List [eBook] OWASP Top Ten [eLearning course] Synopsys involvement with OWASP View the list
Multiple	SEI CERT C, C++, and Java secure coding standards Resources► Coverity Support for SEI CERT C, C++, and Java Coding Standards [datasheet] Synopsys involvement with SEI CERT View the standards
Multiple	SPDX specifications for communicating software bill of material (SBOM) information Resources► Synopsys involvement with SPDX View the specifications
Multiple	UL 2900 standards for software cyber security for network-connectable products Resources► What is UL 2900? Synopsys and UL View the standards
Multiple	UL 2900-2-2 particular requirements for industrial control systems Resources► What is UL 2900? Synopsys and UL View the requirements
Public Sector	Federal Risk and Authorization Management Program (FedRAMP) application security-related controls Resources► What is FedRAMP? Satisfying FedRAMP AppSec Requirements With Synopsys Solutions [datasheet] View the controls
Public Sector	NIST SP 800-161 supply chain risk management practices for federal information systems and organizations Resources► Don’t let supply chain security risks poison your organization [blog post] Don’t be the weak link in your customers’ supply chain security [blog post] Synopsys involvement with NIST View the publication
Telecommunications	ETSI TR 101 583 methods for security testing and specification Resources► View the technical reference
Telecommunications	GSMA FS.16 Network Equipment Security Assurance Scheme (NESAS) development and lifecycle security requirements Resources► View the requirements
Transportation	CENELEC EN 50128 communication, signaling, and processing systems in software for railway control and protection systems Resources► View the standard

Let us help you navigate the complex compliance landscape

Synopsys can help you verify and maintain compliance before, during, and after development.

Many Synopsys employees serve or have served as subject matter experts for committees, boards, working groups, programs, and projects related to software quality and security standards, policies, and regulatory guidelines, as well as open source community initiatives.

View standards and policies collaborations

View open source community initiatives

View compliance training

Let’s talk

Software Quality and Security Standards Compliance

Build compliance into your SDLC

Achieve compliance with help from Synopsys

Laws and regulations

Standards, policies, and guidelines

Let us help you navigate the complex compliance landscape

Corporate Headquarters

Customer Support

Worldwide Location

Legal