Software Quality and Security Standards Compliance

Ensure your software complies with the standards critical to customers and regulators

If your organization manages payments, handles sensitive customer or patient data, or operates in a regulated market, you may need to demonstrate compliance with specific standards to maintain customer trust and avoid legal or regulatory penalties.

Software compliance is more difficult than ever | Synopsys

Achieve compliance with help from Synopsys

Contact us to learn how we can help with your specific compliance objectives.

Laws and regulations

Laws and regulations are the system of rules that a country or community recognizes as regulating the actions of its members and that it may enforce with penalties.

In the U.S., Congress passes bills that the president then signs into law. Once a law is in place, the Office of Management and Budget (OMB) translates it into policy for federal agencies to implement and comply with.

Synopsys tools, services, and eLearning can help support your compliance goals associated with laws and regulations such as those listed here related to software quality, security, safety, privacy, and data protection.

laws and regulations
Industry Law or regulation
Automotive UNECE World Forum for Harmonization of Vehicle Regulations (WP 29) Resources
Financial services Gramm-Leach-Bliley Act (GLBA) Resources
Healthcare European Union (EU) medical devices regulation (MDR) 2017/745 Resources
Federal Food, Drug, and Cosmetic (FD&C) Act Section 510(k) clearance for U.S. medical devices Resources
Health Information Technology for Economic and Clinical Health (HITECH) Act Resources
Health Insurance Portability and Accountability Act (HIPAA) Resources
Multiple California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) Resources
Federal Information Security Management Act and Federal Information Security Modernization Act (FISMA) Resources
General Data Protection Regulation (GDPR) Resources
Sarbanes-Oxley (SOX) Act Resources
Public sector Federal Risk and Authorization Management Program (FedRAMP) Authorization Act Resources

Standards, policies, and guidelines

Policies in the U.S. government are created by OMB or other agencies in response to laws and executive orders to create implementation guidance for government or internal agencies. This guidance can reference relevant standards and National Institute of Standards and Technology (NIST) special publications (SPs).

Guidelines provide direction on how to comply with and implement laws, regulations, and policies.

Standards provide the basis for demonstrating compliance with laws, policies, and regulatory guidelines.

Synopsys tools, services, and eLearning help enable compliance with standards, policies, and guidelines such as those shown below related to software quality, security, safety, privacy, and data protection.

Issues by industry recognized priority lists (PCI DSS 2018)

Sample Synopsys report for PCI DSS showing issues by industry-recognized priority lists

  • This solution maps to a specific requirement for this standard
  • This solution supports a general requirement for building security into the SDLC that the standard recommends
  • Industry
  • Standard, policy, or guidelines
  • Coverity static analysis
  • Black Duck composition analysis
  • Seeker interative analysis
  • Defensics protocol fuzz testing
  • Tinfoil dynamic analysis
  • Services
  • eLearning
Aerospace and defense Cybersecurity Maturity Model Certification (CMMC) data protection controls (89 CWEs and numerous CVEs) Resources
Aerospace and defense Defense Information Systems Agency security technical implementation guides (DISA-STIG) Resources
Aerospace and defense DO-178C software considerations in airborne systems and equipment certification standards Resources
Aerospace and defense Automotive AUTOSAR Adaptive Platform guidelines for the use of the C++14 language in critical and safety-related systems Resources
Aerospace and defense Automotive ISO 26262 functional safety standard for road vehicles Resources
Aerospace and defense Automotive MISRA C and C++ coding standards Resources
Automotive ISO/CD 24089 software update engineering standard for road vehicles Resources
Automotive ISO/SAE 21434 cyber security engineering standard for road vehicles Resources
Automotive TR 68 – 3 cyber security principles and assessment framework for autonomous vehicles Resources
Energy NERC CIP reliability standards Resources
Financial services Monetary Authority of Singapore (MAS) guidelines on technology risk management practices Resources
Financial services Payment Card Industry Data Security Standard (PCI DSS) Resources
Healthcare AAMI TIR57 principles for medical device security risk management Resources
Healthcare ANSI/CAN/UL 2900-2-3 particular requirements for security and life safety signaling systems Resources
Healthcare FDA premarket notification 510(k) Resources
Healthcare IEC 62304 software life cycle processes standard for medical device software Resources
Healthcare UL 2900-2-1 particular requirements for network-connectable components of healthcare and wellness systems Resources
Multiple ANSI/CAN/UL 2900-1 general requirements Resources
Multiple ANSI/ISA/IEC 62443 standards for control system components Resources
Multiple CWE top 25 most dangerous software weaknesses Resources
Multiple Federal Information Processing Standards (FIPS) publications 140-2 and 140-3 security requirements for cryptographic modules Resources
Multiple ISACA Control Objectives for Information and Related Technologies (COBIT) framework Resources
Multiple ISO/IEC 14882 C++ programming languages standard Resources
Multiple ISO/IEC 5055 automated source code quality measures for IT software and software quality measurement (CISQ Automated Source Code Quality Measures) Resources
Multiple ISO/IEC 5230 OpenChain specification for IT Resources
Multiple ISO/IEC TR 24772 guidance to avoiding vulnerabilities in programming languages Resources
Multiple ISO/IEC TS 17961 C secure coding rules standard Resources
Multiple ISO/IEC/IEEE 15026 systems and software assurance standard Resources
Multiple ITU-T X.1520 recommendation on the use of common vulnerabilities and exposures (CVE) Resources
Multiple ITU-T X.1524 recommendation on the use of common weakness enumeration (CWE) Resources
Multiple ITU-T X.1544 recommendation on the use of common attack pattern enumeration and classification (CAPEC) Resources
Multiple NIST SP 800-53 security and privacy controls for information systems and organizations Resources
Multiple OWASP Application Security Verification Standard (ASVS) Resources
Multiple OWASP Mobile Top 10 web application security risks Resources
Multiple OWASP Top 10 web application security risks Resources
Multiple SEI CERT C, C++, and Java secure coding standards Resources
Multiple SPDX specifications for communicating software bill of material (SBOM) information Resources
Multiple UL 2900 standards for software cyber security for network-connectable products Resources
Multiple UL 2900-2-2 particular requirements for industrial control systems Resources
Public Sector Federal Risk and Authorization Management Program (FedRAMP) application security-related controls Resources
Public Sector NIST SP 800-161 supply chain risk management practices for federal information systems and organizations Resources
Telecommunications ETSI TR 101 583 methods for security testing and specification Resources
Telecommunications GSMA FS.16 Network Equipment Security Assurance Scheme (NESAS) development and lifecycle security requirements Resources
Transportation CENELEC EN 50128 communication, signaling, and processing systems in software for railway control and protection systems Resources
We’ll teach you to do your own compliance upkeep | Synopsys

Let us help you navigate the complex compliance landscape

Synopsys can help you verify and maintain compliance before, during, and after development.

Many Synopsys employees serve or have served as subject matter experts for committees, boards, working groups, programs, and projects related to software quality and security standards, policies, and regulatory guidelines, as well as open source community initiatives.

View standards and policies collaborations

View open source community initiatives

View compliance training