Skip to content

The compliance lifecycle

Bringing a codebase into conformance with a coding standard is a repeatable loop, not a one-time scan. This page is the map: each step below routes to the page that shows you how. Work through them in order the first time; after that you mostly live in the gate and document steps.

The five steps

Step What you do Where
1. Choose a standard Pick the published standard (or subset) your project is obligated to and start from its built-in configuration — the full shipped list is in the standards catalog. Which standard should I check against?
2. Gate new violations Run the standard continuously so new violations are caught before they merge — locally in the background and in CI. Run in the background, Run in CI
3. Baseline existing violations Accept the current backlog as a baseline so the report focuses on new issues while you burn down the old ones. Baseline existing violations
4. Document deviations For violations you accept, record an in-code deviation with rationale so the acceptance is traceable. Suppress a violation / document a deviation
5. Report for auditors Generate the per-rule Compliance Report — the deliverable that shows Compliant / Not Compliant / Not Supported for every rule. Produce a compliance report

How the steps fit together

Gate vs. baseline — they solve different problems

Gating (step 2) stops the backlog from growing: every new commit is checked, and CI fails on fresh violations. Baselining (step 3) hides the pre-existing backlog from the pass/fail signal so the team isn't blocked while it's paid down. Use both together — gate on new, baseline the old.

Deviations are part of the report, not a way around it

A documented deviation doesn't erase a violation; it turns it into an accepted, justified exception. The compliance report pairs the automated Not Compliant and Not Supported rows with your recorded deviations so an auditor sees the full picture — what passed, what needs manual review, and what was consciously accepted and why.

Automate the loop

Steps 2 and 5 should run without anyone remembering to click. Wire the standard's configuration into your pipeline so every build re-checks the code and can emit fresh reports:

If your standard is a safety standard

Functional-safety and avionics programs add a tool-qualification obligation on top of the conformance loop above: