SonarQube

NIST SSDF Executive Summary: "Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences." PW.7.1: "Determine whether code review or code analysis tools are used to find issues in code either in a fully automated way or in conjunction with a person." PW.7.2: "Use a static analysis tool to automatically check code for vulnerabilities and compliance with the organization's secure coding standards." PW.5.1: "Implement processes, tools, and techniques for detecting, preventing, and remediating vulnerabilities in the software." RV.1.2: "Review, analyze, and/or test the software's code to identify or confirm the presence of previously undetected vulnerabilities." SonarQube implements automated static analysis aligned with these SSDF requirements.

Secure code review methodology. SonarQube automates detection of OWASP Top 10 vulnerabilities and provides remediation guidance.

Security rules documentation covering CWE, OWASP, SANS Top 25 mappings with detection and remediation details.

SOC 2 CC8.1: "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives." SonarQube Quality Gates enforce testing and approval of code changes before deployment, directly supporting CC8.1 change management requirements. Source: AICPA Trust Services Criteria.

ISO 27001:2022 A.8.25: "Rules for the secure development of software and systems shall be established and applied to developments within the organisation." SonarQube enforces secure coding standards through automated static analysis and quality gates, implementing ISO 27001 secure development requirements. Source: ISO/IEC 27001:2022 Annex A.

ISO 27001:2022 A.8.28: "Secure coding principles shall be applied to software development." SonarQube detects violations of secure coding practices including OWASP Top 10 vulnerabilities, CWE weaknesses, and SANS Top 25 errors, enabling organizations to enforce A.8.28 requirements. Source: ISO/IEC 27001:2022 Annex A.