Can SonarQube scan the source code for FIPS 140-2 compliance?

[anon67236913]

Welcome

there was already a similar question in 2020, the answer was

Check for FIPS 140-2 compliance using SonarQube

Hi @kirann welcome to the community! Recently, we have greatly improved SonarQube cryptography rules for the Java language, see for example this product announcement. Some of these rules are based on FIPS or other NIST recommendations, for example the rule S4426 is based on the NIST special publication 800-131a which is pretty aligned with FIPS (or even stricter). Depending on the development language of your software components, SonarQube can currently be a great help in achieving FIPS compl…

Gilbert