100 % Compliance Coverage
Every one of the 708 builtin rules is mapped to a published standard. No rule ships without a traceability anchor.
In addition, ISO/IEC 27001:2022 (93 controls), OWASP ASVS v5.0.0 (348 requirements) and NIST CSF 2.0 (108 sub-categories) are matrixed in every report. Findings carry their compliance metadata in JSON, SARIF (rule.properties.tags) and HTML.
Supported Standards
Every finding is mapped to one or more international standards.
OWASP Foundation · USA
OWASP Top 10
The 10 most critical web app security risks. SCA tags each finding with its Top 10 category so security teams instantly see the risk class.
MITRE · USA
CWE
MITRE's catalog of 1 000+ software weaknesses. Standardized IDs (e.g., CWE-89 for SQL injection) for unambiguous comparison across tools.
W3C · International
WCAG 2.1
W3C accessibility standard. Required by EU/US public sectors and enforced by the European Accessibility Act 2025 for private sector.
European Union · 2018
GDPR / RGPD
EU personal-data protection regulation. SCA flags hardcoded personal data and missing encryption on sensitive fields. Fines reach 4% of global revenue.
OWASP Foundation · USA
OWASP CI/CD
Top 10 risks specific to CI/CD pipelines. SCA scans GitHub Actions and GitLab CI for unsafe patterns — pipelines have direct access to secrets and production.
OASIS / OWASP · International
SARIF & SBOM
Industry-standard exports. SARIF feeds GitHub Code Scanning and GitLab SAST; SBOM CycloneDX is required by US Executive Order 14028 for federal contractors.
ISO + IEC · International
ISO 27001
ISMS control catalog (93 Annex A controls). Often required by enterprise contracts for certification.
OWASP Foundation · USA
OWASP ASVS
Application security verification checklist (348 requirements). What auditors run on apps to verify security.
NIST · USA
NIST CSF 2.0
Cybersecurity outcomes across 6 functions. Required for US federal contractors and used in finance/healthcare.
ISO/IEC 27001:2022 — Annex A
ISO + IEC · International
ISO/IEC 27001:2022 — Annex A
Compliance matrix mapping 157 detection rules to 93 Annex A controls.
ISO/IEC 27001 certification is a contractual requirement for many enterprise clients and the de-facto international ISMS standard. The Annex A control catalog gives auditors a checklist of safeguards. SCA pre-fills the technological controls (A.8) visible in source code — your auditor focuses on processes, not code review.
SAST tools primarily cover technological controls (A.8). The compliance matrix indicates which controls are testable by static analysis, not full compliance certification.
All 93 controls — click a theme to expand
A.5
Organizational
37 controls
- A.5.1 Policies for information security
- A.5.2 Information security roles and responsibilities
- A.5.3 Segregation of duties
- A.5.4 Management responsibilities
- A.5.5 Contact with authorities
- A.5.6 Contact with special interest groups
- A.5.7 Threat intelligence
- A.5.8 Information security in project management
- A.5.9 Inventory of information and other associated assets
- A.5.10 Acceptable use of information and other associated assets
- A.5.11 Return of assets
- A.5.12 Classification of information
- A.5.13 Labelling of information
- A.5.14 Information transfer
- A.5.15 Access control
- A.5.16 Identity management
- A.5.17 Authentication information
- A.5.18 Access rights
- A.5.19 Information security in supplier relationships
- A.5.20 Addressing information security within supplier agreements
- A.5.21 Managing information security in the ICT supply chain
- A.5.22 Monitoring, review and change management of supplier services
- A.5.23 Information security for use of cloud services
- A.5.24 Information security incident management planning and preparation
- A.5.25 Assessment and decision on information security events
- A.5.26 Response to information security incidents
- A.5.27 Learning from information security incidents
- A.5.28 Collection of evidence
- A.5.29 Information security during disruption
- A.5.30 ICT readiness for business continuity
- A.5.31 Legal, statutory, regulatory and contractual requirements
- A.5.32 Intellectual property rights
- A.5.33 Protection of records
- A.5.34 Privacy and protection of PII
- A.5.35 Independent review of information security
- A.5.36 Compliance with policies, rules and standards for information security
- A.5.37 Documented operating procedures
A.6
People
8 controls
- A.6.1 Screening
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness, education and training
- A.6.4 Disciplinary process
- A.6.5 Responsibilities after termination or change of employment
- A.6.6 Confidentiality or non-disclosure agreements
- A.6.7 Remote working
- A.6.8 Information security event reporting
A.7
Physical
14 controls
- A.7.1 Physical security perimeters
- A.7.2 Physical entry
- A.7.3 Securing offices, rooms and facilities
- A.7.4 Physical security monitoring
- A.7.5 Protecting against physical and environmental threats
- A.7.6 Working in secure areas
- A.7.7 Clear desk and clear screen
- A.7.8 Equipment siting and protection
- A.7.9 Security of assets off-premises
- A.7.10 Storage media
- A.7.11 Supporting utilities
- A.7.12 Cabling security
- A.7.13 Equipment maintenance
- A.7.14 Secure disposal or re-use of equipment
A.8
Technological
34 controls
- A.8.1 User endpoint devices
- A.8.2 Privileged access rights
- A.8.3 Information access restriction
- A.8.4 Access to source code
- A.8.5 Secure authentication
- A.8.6 Capacity management
- A.8.7 Protection against malware
- A.8.8 Management of technical vulnerabilities
- A.8.9 Configuration management
- A.8.10 Information deletion
- A.8.11 Data masking
- A.8.12 Data leakage prevention
- A.8.13 Information backup
- A.8.14 Redundancy of information processing facilities
- A.8.15 Logging
- A.8.16 Monitoring activities
- A.8.17 Clock synchronization
- A.8.18 Use of privileged utility programs
- A.8.19 Installation of software on operational systems
- A.8.20 Networks security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- A.8.23 Web filtering
- A.8.24 Use of cryptography
- A.8.25 Secure development life cycle
- A.8.26 Application security requirements
- A.8.27 Secure system architecture and engineering principles
- A.8.28 Secure coding
- A.8.29 Security testing in development and acceptance
- A.8.30 Outsourced development
- A.8.31 Separation of development, test and production environments
- A.8.32 Change management
- A.8.33 Test information
- A.8.34 Protection of information systems during audit testing
Coverage by SAST is intrinsically partial: physical security (A.7) and HR (A.6) controls require organizational measures outside the scope of static analysis. SCA covers what code can prove.
OWASP ASVS v5.0.0
OWASP Foundation · USA
OWASP ASVS v5.0.0
Compliance matrix mapping 106 detection rules to 348 ASVS requirements across 17 chapters.
Where the OWASP Top 10 lists the most common risks, ASVS lists the verifications an auditor performs on an application. It's structured by chapter (V1 architecture, V3 sessions, V6 cryptography…) and by level (1, 2, 3). SCA automates Level-1 input/output checks, freeing verifiers to focus on threat-modelling and design review.
ASVS v5.0.0 defines 348 requirements across 17 chapters. This scanner maps 44 of them (~13%) to a detection rule — runtime, infrastructure and procedural requirements need separate assessment.
Full guide: what a SAST scan actually covers in ASVS v5.0.0 →NIST CSF 2.0
NIST · USA
NIST CSF 2.0
NIST Cybersecurity Framework 2.0 — coverage of subcategories detectable by static analysis.
NIST CSF 2.0 is the de-facto cybersecurity framework for US federal contractors and is increasingly adopted in finance and healthcare. Unlike ISO 27001 (which lists controls), CSF lists outcomes — what your security program must achieve. SCA covers the technical subcategories under Protect, Detect, and Identify; the Govern, Respond, and Recover functions are organizational and outside SAST scope.
Coverage focuses on technical subcategories detectable by SAST. Respond (RS) and Recover (RC) functions are organizational — outside the scope of static analysis.
Authoritative sources
Direct links to every standards body referenced on this page.