One example of a standard software might comply with is MISRA C [1]. For that, you ignore a large chunk of the C language to something much less prone to bugs. Others might be HIPAA compliance, how you handle personal information to be compliant with GDPR or the VW diesel emissions scandal a few years ago.
What are these standardised ways to measure developer output? I've never seen any, beyond "burndown charts" and "LOC", which I don't believe pass the sniff test.