We did actually produce ISO/IEC TS 17961:2013 Information technology -- Programming languages, their environments and system software interfaces -- C secure coding rules http://www.iso.org/iso/catalogue_detail.htm?csnumber=61134

The rules specified in this Technical Specification apply to analyzers, including static analysis tools and C language compiler vendors that wish to diagnose insecure code beyond the requirements of the language standard. All rules are meant to be enforceable by static analysis.

I wrote an article putting all this in some context at: http://www.informit.com/articles/article.aspx?p=2088511

Yes, but it is above all a culture problem.

Many developers think that they don't need static analyzers.

Actually lint was part of the original UNIX, but since it took some effort to configure and not everyone agreed with the rules, it was seldom ported to other systems, and it became part of the C culture not to use it.

I think we have to thank the LLVM project that now static analyzers are welcome in C.

It can, and it is. One of the outcomes of the CERT C secure coding standard was the publication of TS 17961, which is an ISO document on C analyzability, which also went hand in hand with the Annex L (normative) section of the C standard.

Basically, the CERT rules all must be analyzable (though some require dynamic analysis instead of static analysis).

I do some work in the static analysis industry, and it's common to see analyses based on various coding standards, including this one.