SEI CERT C Coding Standard

Introduction - Development Process
will, in many cases, make it easier to conform to the rules, eliminating many potential sources of
defects.
1.8.2 Levels
Rules and recommendations in this standard are classified into three levels (see How this Coding
Standard is Organized). Emphasis should be placed on conformance Level 1 (L1) rules. Software
systems that have been validated as complying with all Level 1 rules are considered to be L1 conforming.
Software systems can be assessed as L1, L2, or fully conforming, depending on the set
of rules to which the system has been validated.
1.8.3 Deviation Procedure
Strict adherence to all rules is unlikely and, consequently, deviations associated with specific rule
violations are necessary. Deviations can be used in cases where a true-positive finding is uncontested
as a rule violation but the code is nonetheless determined to be correct. An uncontested
true-positive finding may be the result of a design or architecture feature of the software or may
occur for a valid reason that was unanticipated by the coding standard. In this respect, the deviation
procedure allows for the possibility that coding rules are overly strict [Seacord 2013].
Deviations are not granted for reasons of performance or usability. A software system that successfully
passes conformance testing must not contain defects or exploitable vulnerabilities. Deviation
requests are evaluated by the lead assessor, and if the developer can provide sufficient evidence
that the deviation will not result in a vulnerability, the deviation request is accepted.
Deviations are used infrequently because it is almost always easier to fix a coding error than it is
to provide an argument that the coding error does not result in a vulnerability.
1.9 Development Process
The development of a coding standard for any programming language is a difficult undertaking
that requires significant community involvement. The following development process has been
used to create this standard:
1. Rules and recommendations for a coding standard are solicited from the communities involved
in the development and application of each programming language, including the formal
or de facto standards bodies responsible for the documented standard.
2. These rules and recommendations are edited by members of the CERT technical staff for
content and style and placed on the CERT Secure Coding Standards website for comment
and review.
3. The user community may then comment on the publicly posted content using threaded discussions
and other communication tools. Once a consensus develops that the rule or recommendation
is appropriate and correct, the final rule is incorporated into an officially released
version of the secure coding standard.
SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems 12
Software Engineering Institute | Carnegie Mellon University
[DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution.