Software Assurance & Embedded Security Evaluation Guide

Assurance tooling is scoped by the standard you have to satisfy and the evidence an assessor will ask for. Start from the claim you need to make, then work back to the analysis that supports it.

Selection Requirements to Establish

Work through what you can. Anything still undecided is exactly what a conversation with our engineers is for.

01Code and toolchain

  • Languages and language versions in the codebase
  • Compiler, target architecture and build system
  • Approximate code size, and how much is legacy or third-party
  • Development environment and version control
  • Whether the code runs on a host, an RTOS or bare metal

02Standards and evidence

  • Functional safety or security standard in scope (IEC 61508, ISO 26262, DO-178C, IEC 62304, IEC 62443)
  • Coding guideline to be enforced (MISRA, AUTOSAR C++, CERT)
  • Structural coverage required: statement, branch or MC/DC
  • Requirements management and bidirectional traceability
  • Deviation handling, and the review record an assessor expects

03Verification and deployment

  • Static analysis, unit test, integration test and formal verification scope
  • Runtime error detection and memory-safety analysis
  • Continuous integration environment, and where analysis runs
  • Cryptography, secure boot and TLS requirements on the device
  • Team size, seat count and licence model (node-locked, floating, CI)
Other guides

Related selection guides

Cross-domain projectsEngineering Project Discovery GuideA starting point for cross-domain engineering projects. Test & MeasurementOscilloscope Selection GuideHow to define bandwidth, channels, sample rate, memory depth, probing and triggering before selecting an oscilloscope. Test & MeasurementTest & Measurement Requirements GuideHow to specify instrument type, measurement range, accuracy, bandwidth and automation for an electronic test and measurement requirement.