If your organization manages payments, handles sensitive customer or patient data, or operates in a regulated market, you may need to demonstrate compliance with specific standards to maintain customer trust and avoid legal or regulatory penalties.
Contact us to learn how we can help with your specific compliance objectives.
Laws and regulations are the system of rules that a country or community recognizes as regulating the actions of its members and that it may enforce with penalties.
In the U.S., Congress passes bills that the president then signs into law. Once a law is in place, the Office of Management and Budget (OMB) translates it into policy for federal agencies to implement and comply with.
Synopsys tools and services can help support your compliance goals associated with laws and regulations such as those listed here related to software quality, security, safety, privacy, and data protection.
Industry | Law or regulation |
---|---|
Automotive | UNECE World Forum for Harmonization of Vehicle Regulations (WP 29) Resources► |
Financial services |
Gramm-Leach-Bliley Act (GLBA)
Resources►
|
Healthcare | European Union (EU) medical devices regulation (MDR) 2017/745 Resources► |
Federal Food, Drug, and Cosmetic (FD&C) Act Section 510(k) clearance for U.S. medical devices Resources► | |
Health Information Technology for Economic and Clinical Health (HITECH) Act Resources► | |
Health Insurance Portability and Accountability Act (HIPAA) Resources► | |
Multiple | California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) Resources► |
Federal Information Security Management Act and Federal Information Security Modernization Act (FISMA) Resources► | |
General Data Protection Regulation (GDPR)
Resources►
|
|
Sarbanes-Oxley (SOX) Act Resources► | |
Public sector | Federal Risk and Authorization Management Program (FedRAMP) Authorization Act Resources► |
Policies in the U.S. government are created by OMB or other agencies in response to laws and executive orders to create implementation guidance for government or internal agencies. This guidance can reference relevant standards and National Institute of Standards and Technology (NIST) special publications (SPs).
Guidelines provide direction on how to comply with and implement laws, regulations, and policies.
Standards provide the basis for demonstrating compliance with laws, policies, and regulatory guidelines.
Synopsys tools and services help enable compliance with standards, policies, and guidelines such as those shown below related to software quality, security, safety, privacy, and data protection.
Sample Synopsys report for PCI DSS showing issues by industry-recognized priority lists
Print table
Aerospace and defense | Cybersecurity Maturity Model Certification (CMMC) data protection controls (89 CWEs and numerous CVEs) Resources► | |||||||
---|---|---|---|---|---|---|---|---|
Aerospace and defense | Defense Information Systems Agency security technical implementation guides (DISA-STIG) Resources► | |||||||
Aerospace and defense | DO-178C software considerations in airborne systems and equipment certification standards Resources► | |||||||
Aerospace and defense Automotive | AUTOSAR Adaptive Platform guidelines for the use of the C++14 language in critical and safety-related systems Resources► | |||||||
Aerospace and defense Automotive | ISO 26262 functional safety standard for road vehicles Resources► | |||||||
Aerospace and defense Automotive | MISRA C and C++ coding standards Resources► | |||||||
Automotive | ISO/CD 24089 software update engineering standard for road vehicles Resources► | |||||||
Automotive | ISO/SAE 21434 cyber security engineering standard for road vehicles Resources► | |||||||
Automotive | TR 68 – 3 cyber security principles and assessment framework for autonomous vehicles Resources► | |||||||
Energy | NERC CIP reliability standards Resources► | |||||||
Financial services | Monetary Authority of Singapore (MAS) guidelines on technology risk management practices Resources► | |||||||
Financial services |
Payment Card Industry Data Security Standard (PCI DSS)
Resources►
|
|||||||
Healthcare | AAMI TIR57 principles for medical device security risk management Resources► | |||||||
Healthcare | ANSI/CAN/UL 2900-2-3 particular requirements for security and life safety signaling systems Resources► | |||||||
Healthcare |
FDA premarket notification 510(k)
Resources►
|
|||||||
Healthcare | IEC 62304 software life cycle processes standard for medical device software Resources► | |||||||
Healthcare |
UL 2900-2-1 particular requirements for network-connectable components of healthcare and wellness systems
Resources►
|
|||||||
Multiple | ANSI/CAN/UL 2900-1 general requirements Resources► | |||||||
Multiple | ANSI/ISA/IEC 62443 standards for control system components Resources► | |||||||
Multiple | CWE top 25 most dangerous software weaknesses Resources► | |||||||
Multiple | Federal Information Processing Standards (FIPS) publications 140-2 and 140-3 security requirements for cryptographic modules Resources► | |||||||
Multiple | ISACA Control Objectives for Information and Related Technologies (COBIT) framework Resources► | |||||||
Multiple | ISO/IEC 14882 C++ programming languages standard Resources► | |||||||
Multiple | ISO/IEC 5055 automated source code quality measures for IT software and software quality measurement (CISQ Automated Source Code Quality Measures) Resources► | |||||||
Multiple | ISO/IEC 5230 OpenChain specification for IT Resources► | |||||||
Multiple | ISO/IEC TR 24772 guidance to avoiding vulnerabilities in programming languages Resources► | |||||||
Multiple | ISO/IEC TS 17961 C secure coding rules standard Resources► | |||||||
Multiple | ISO/IEC/IEEE 15026 systems and software assurance standard Resources► | |||||||
Multiple | ITU-T X.1520 recommendation on the use of common vulnerabilities and exposures (CVE) Resources► | |||||||
Multiple | ITU-T X.1524 recommendation on the use of common weakness enumeration (CWE) Resources► | |||||||
Multiple | ITU-T X.1544 recommendation on the use of common attack pattern enumeration and classification (CAPEC) Resources► | |||||||
Multiple | NIST SP 800-53 security and privacy controls for information systems and organizations Resources► | |||||||
Multiple | OWASP Application Security Verification Standard (ASVS) Resources► | |||||||
Multiple | OWASP Mobile Top 10 web application security risks Resources► | |||||||
Multiple | OWASP Top 10 web application security risks Resources► | |||||||
Multiple | SEI CERT C, C++, and Java secure coding standards Resources► | |||||||
Multiple | SPDX specifications for communicating software bill of material (SBOM) information Resources► | |||||||
Multiple | UL 2900 standards for software cyber security for network-connectable products Resources► | |||||||
Multiple | UL 2900-2-2 particular requirements for industrial control systems Resources► | |||||||
Public Sector | Federal Risk and Authorization Management Program (FedRAMP) application security-related controls Resources► | |||||||
Public Sector | NIST SP 800-161 supply chain risk management practices for federal information systems and organizations Resources► | |||||||
Telecommunications | ETSI TR 101 583 methods for security testing and specification Resources► | |||||||
Telecommunications | GSMA FS.16 Network Equipment Security Assurance Scheme (NESAS) development and lifecycle security requirements Resources► | |||||||
Transportation | CENELEC EN 50128 communication, signaling, and processing systems in software for railway control and protection systems Resources► |
Synopsys can help you verify and maintain compliance before, during, and after development.
Many Synopsys employees serve or have served as subject matter experts for committees, boards, working groups, programs, and projects related to software quality and security standards, policies, and regulatory guidelines, as well as open source community initiatives.