diff --git a/.clang-tidy b/.clang-tidy
index 9cf476b6a81..c6325ca55ba 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -2,6 +2,7 @@ Checks:
 '-*,
   clang-analyzer-*,
   -clang-diagnostic-shadow-uncaptured-local,
+  -clang-analyzer-optin.core.EnumCastOutOfRange,
   cert-*,
   modernize-*,
   -modernize-avoid-c-arrays,
diff --git a/cpp/include/DataStorm/InternalT.h b/cpp/include/DataStorm/InternalT.h
index 5cec41a9ae0..12f7427e79f 100644
--- a/cpp/include/DataStorm/InternalT.h
+++ b/cpp/include/DataStorm/InternalT.h
@@ -28,13 +28,13 @@ namespace DataStormI
     template<typename T> class has_communicator_parameter
     {
         template<typename TT, typename SS>
-        static auto testE(int)
+        static auto testE(int) noexcept
             -> decltype(TT::encode(std::declval<Ice::CommunicatorPtr&>(), std::declval<SS&>()), std::true_type());
 
         template<typename, typename> static auto testE(...) -> std::false_type;
 
         template<typename TT, typename SS>
-        static auto testD(int)
+        static auto testD(int) noexcept
             -> decltype(TT::decode(std::declval<Ice::CommunicatorPtr&>(), Ice::ByteSeq()), std::true_type());
 
         template<typename, typename> static auto testD(...) -> std::false_type;
@@ -79,9 +79,9 @@ namespace DataStormI
     template<typename T> class is_streamable
     {
         template<typename TT, typename SS>
-        static auto test(int) -> decltype(std::declval<SS&>() << std::declval<TT>(), std::true_type());
+        static auto test(int) noexcept -> decltype(std::declval<SS&>() << std::declval<TT>(), std::true_type());
 
-        template<typename, typename> static auto test(...) -> std::false_type;
+        template<typename, typename> static auto test(...) noexcept -> std::false_type;
 
     public:
         static const bool value = decltype(test<T, std::ostream>(0))::value;
diff --git a/cpp/include/Ice/LoggerUtil.h b/cpp/include/Ice/LoggerUtil.h
index e164ca1e83f..809f378dfcf 100644
--- a/cpp/include/Ice/LoggerUtil.h
+++ b/cpp/include/Ice/LoggerUtil.h
@@ -44,8 +44,8 @@ namespace Ice
 
     template<typename T> struct IsException
     {
-        static char testex(Ice::Exception*);
-        static long testex(...);
+        static char testex(Ice::Exception*) noexcept;
+        static long testex(...) noexcept;
 
         static const bool value = sizeof(testex(static_cast<T*>(nullptr))) == sizeof(char);
     };
diff --git a/cpp/include/Ice/Proxy.h b/cpp/include/Ice/Proxy.h
index 88a1a8041ec..770d6b1f5ac 100644
--- a/cpp/include/Ice/Proxy.h
+++ b/cpp/include/Ice/Proxy.h
@@ -259,8 +259,8 @@ namespace Ice
 
         // The copy constructor and assignment operators are to keep GCC happy.
         Proxy(const Proxy&) noexcept = default;
-        Proxy& operator=(const Proxy&) noexcept { return *this; }
-        Proxy& operator=(Proxy&&) noexcept { return *this; }
+        Proxy& operator=(const Proxy&) noexcept { return *this; } // NOLINT
+        Proxy& operator=(Proxy&&) noexcept { return *this; }      // NOLINT
 
     private:
         Prx fromReference(IceInternal::ReferencePtr&& ref) const
diff --git a/cpp/include/Ice/StreamableTraits.h b/cpp/include/Ice/StreamableTraits.h
index 67b96f11a94..cef315a42db 100644
--- a/cpp/include/Ice/StreamableTraits.h
+++ b/cpp/include/Ice/StreamableTraits.h
@@ -81,9 +81,9 @@ namespace Ice
      */
     template<typename T> struct IsContainer
     {
-        template<typename C> static char test(typename C::iterator*);
+        template<typename C> static char test(typename C::iterator*) noexcept;
 
-        template<typename C> static long test(...);
+        template<typename C> static long test(...) noexcept;
 
         static const bool value = sizeof(test<T>(0)) == sizeof(char);
     };
@@ -95,9 +95,9 @@ namespace Ice
      */
     template<typename T> struct IsMap
     {
-        template<typename C> static char test(typename C::mapped_type*);
+        template<typename C> static char test(typename C::mapped_type*) noexcept;
 
-        template<typename C> static long test(...);
+        template<typename C> static long test(...) noexcept;
 
         static const bool value = IsContainer<T>::value && sizeof(test<T>(0)) == sizeof(char);
     };
diff --git a/cpp/src/DataStorm/TopicI.cpp b/cpp/src/DataStorm/TopicI.cpp
index 45943e41899..a249e5c5126 100644
--- a/cpp/src/DataStorm/TopicI.cpp
+++ b/cpp/src/DataStorm/TopicI.cpp
@@ -13,7 +13,7 @@ using namespace DataStormContract;
 
 namespace
 {
-    static Topic::Updater noOpUpdater =
+    static Topic::Updater noOpUpdater = // NOLINT:cert-err58-cpp
         [](const shared_ptr<Sample>& previous, const shared_ptr<Sample>& next, const Ice::CommunicatorPtr&)
     { next->setValue(previous); };
 
@@ -38,7 +38,7 @@ namespace
 
         bool match(const shared_ptr<Filterable>&) const final { return true; }
     };
-    const auto alwaysMatchFilter = make_shared<AlwaysMatchFilter>();
+    const auto alwaysMatchFilter = make_shared<AlwaysMatchFilter>(); // NOLINT:cert-err58-cpp
 
     DataStorm::ClearHistoryPolicy parseClearHistory(const std::string& value)
     {
diff --git a/cpp/src/DataStorm/TraceUtil.h b/cpp/src/DataStorm/TraceUtil.h
index 71e5c1eb767..faefb6ded92 100644
--- a/cpp/src/DataStorm/TraceUtil.h
+++ b/cpp/src/DataStorm/TraceUtil.h
@@ -11,7 +11,8 @@
 #include "SessionI.h"
 #include "TopicI.h"
 
-namespace std
+// TODO: explain why we need to use namespace std here.
+namespace std // NOLINT:cert-dcl58-cpp
 {
     template<typename T> inline std::ostream& operator<<(std::ostream& os, const std::vector<T>& p)
     {
@@ -205,7 +206,7 @@ namespace DataStormI
         return os;
     }
 
-    class TraceLevels
+    class TraceLevels // NOLINT:clang-analyzer-optin.performance.Padding
     {
     public:
         TraceLevels(const Ice::PropertiesPtr&, Ice::LoggerPtr);
diff --git a/cpp/src/Glacier2/InstrumentationI.cpp b/cpp/src/Glacier2/InstrumentationI.cpp
index db973d952bb..1a91e285eae 100644
--- a/cpp/src/Glacier2/InstrumentationI.cpp
+++ b/cpp/src/Glacier2/InstrumentationI.cpp
@@ -22,7 +22,7 @@ namespace
         class Attributes : public AttributeResolverT<SessionHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &SessionHelper::getInstanceName);
                 add("id", &SessionHelper::getId);
diff --git a/cpp/src/Glacier2CryptPermissionsVerifier/CryptPermissionsVerifierI.cpp b/cpp/src/Glacier2CryptPermissionsVerifier/CryptPermissionsVerifierI.cpp
index 24683e7487b..4c499500d60 100644
--- a/cpp/src/Glacier2CryptPermissionsVerifier/CryptPermissionsVerifierI.cpp
+++ b/cpp/src/Glacier2CryptPermissionsVerifier/CryptPermissionsVerifierI.cpp
@@ -107,9 +107,9 @@ namespace
     {
 #if defined(__APPLE__) || defined(_WIN32)
 
-        const string padBytes0 = "";
-        const string padBytes1 = "=";
-        const string padBytes2 = "==";
+        const char* const padBytes0 = "";
+        const char* const padBytes1 = "=";
+        const char* const padBytes2 = "==";
 
         inline string paddingBytes(size_t length)
         {
diff --git a/cpp/src/Ice/ArgVector.cpp b/cpp/src/Ice/ArgVector.cpp
index 18f91f2364e..9dd2fc1e42e 100644
--- a/cpp/src/Ice/ArgVector.cpp
+++ b/cpp/src/Ice/ArgVector.cpp
@@ -32,10 +32,13 @@ IceInternal::ArgVector::ArgVector(const ArgVector& rhs)
 IceInternal::ArgVector&
 IceInternal::ArgVector::operator=(const ArgVector& rhs)
 {
-    delete[] argv;
-    argv = nullptr;
-    _args = rhs._args;
-    setupArgcArgv();
+    if (this != &rhs)
+    {
+        delete[] argv;
+        argv = nullptr;
+        _args = rhs._args;
+        setupArgcArgv();
+    }
     return *this;
 }
 
diff --git a/cpp/src/Ice/CtrlCHandler.cpp b/cpp/src/Ice/CtrlCHandler.cpp
index 0f0dd45975d..626e2f4a05b 100644
--- a/cpp/src/Ice/CtrlCHandler.cpp
+++ b/cpp/src/Ice/CtrlCHandler.cpp
@@ -205,12 +205,12 @@ CtrlCHandler::~CtrlCHandler()
     //
     void* status = nullptr;
 #    ifndef NDEBUG
-    int rc = pthread_kill(_tid, SIGTERM);
+    int rc = pthread_kill(_tid, SIGTERM); // NOLINT:cert-pos44-c
     assert(rc == 0);
     rc = pthread_join(_tid, &status);
     assert(rc == 0);
 #    else
-    pthread_kill(_tid, SIGTERM);
+    pthread_kill(_tid, SIGTERM); // NOLINT:cert-pos44-c
     pthread_join(_tid, &status);
 #    endif
 }
diff --git a/cpp/src/Ice/Exception.cpp b/cpp/src/Ice/Exception.cpp
index d815443340c..aa032ad1603 100644
--- a/cpp/src/Ice/Exception.cpp
+++ b/cpp/src/Ice/Exception.cpp
@@ -15,7 +15,7 @@
 // For UINTPTR_MAX on Ubuntu Precise
 //
 #ifndef __STDC_LIMIT_MACROS
-#    define __STDC_LIMIT_MACROS
+#    define __STDC_LIMIT_MACROS // NOLINT
 #endif
 
 #include "Ice/Exception.h"
diff --git a/cpp/src/Ice/FileUtil.cpp b/cpp/src/Ice/FileUtil.cpp
index f6a36efa72b..2a546ff5d41 100644
--- a/cpp/src/Ice/FileUtil.cpp
+++ b/cpp/src/Ice/FileUtil.cpp
@@ -22,17 +22,6 @@
 
 using namespace std;
 
-namespace IceInternal
-{
-#ifdef _WIN32
-    const string pathsep = ";";
-    const string separator = "\\";
-#else
-    const string pathsep = ":";
-    const string separator = "/";
-#endif
-}
-
 //
 // Determine if path is an absolute path
 //
diff --git a/cpp/src/Ice/FileUtil.h b/cpp/src/Ice/FileUtil.h
index 02d8896cc58..fbd925eb1d3 100644
--- a/cpp/src/Ice/FileUtil.h
+++ b/cpp/src/Ice/FileUtil.h
@@ -22,8 +22,11 @@
 
 namespace IceInternal
 {
-    extern const ICE_API std::string pathsep;
-    extern const ICE_API std::string separator;
+#ifdef _WIN32
+    const char* const separator = "\\";
+#else
+    const char* const separator = "/";
+#endif
 
     //
     // Determine if path is an absolute path.
diff --git a/cpp/src/Ice/HttpParser.cpp b/cpp/src/Ice/HttpParser.cpp
index dccb351353b..68570d0b878 100644
--- a/cpp/src/Ice/HttpParser.cpp
+++ b/cpp/src/Ice/HttpParser.cpp
@@ -18,7 +18,9 @@ namespace
     // Convert a byte array to a string
     string bytesToString(const byte* begin, const byte* end)
     {
-        return string(reinterpret_cast<const char*>(begin), reinterpret_cast<const char*>(end));
+        assert(begin);
+        assert(end);
+        return string{reinterpret_cast<const char*>(begin), reinterpret_cast<const char*>(end)};
     }
 }
 
diff --git a/cpp/src/Ice/Instance.cpp b/cpp/src/Ice/Instance.cpp
index c8f67ad97c4..9e28ac16343 100644
--- a/cpp/src/Ice/Instance.cpp
+++ b/cpp/src/Ice/Instance.cpp
@@ -129,7 +129,7 @@ namespace
     class Init
     {
     public:
-        Init()
+        Init() noexcept
         {
             // Although probably not necessary here, we consistently lock
             // staticMutex before accessing instanceList.
diff --git a/cpp/src/Ice/InstrumentationI.cpp b/cpp/src/Ice/InstrumentationI.cpp
index beee738e894..b59d8195c1b 100644
--- a/cpp/src/Ice/InstrumentationI.cpp
+++ b/cpp/src/Ice/InstrumentationI.cpp
@@ -77,7 +77,7 @@ namespace
         class Attributes : public AttributeResolverT<ConnectionHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &ConnectionHelper::getParent);
                 add("id", &ConnectionHelper::getId);
@@ -182,7 +182,7 @@ namespace
         class Attributes : public AttributeResolverT<DispatchHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &DispatchHelper::getParent);
                 add("id", &DispatchHelper::getId);
@@ -287,7 +287,7 @@ namespace
         class Attributes : public AttributeResolverT<InvocationHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &InvocationHelper::getParent);
                 add("id", &InvocationHelper::getId);
@@ -417,7 +417,7 @@ namespace
         class Attributes : public AttributeResolverT<RemoteInvocationHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &RemoteInvocationHelper::getParent);
                 add("id", &RemoteInvocationHelper::getId);
@@ -502,7 +502,7 @@ namespace
         class Attributes : public AttributeResolverT<CollocatedInvocationHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &CollocatedInvocationHelper::getParent);
                 add("id", &CollocatedInvocationHelper::getId);
@@ -546,7 +546,7 @@ namespace
         class Attributes : public AttributeResolverT<ThreadHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &ThreadHelper::_parent);
                 add("id", &ThreadHelper::_id);
@@ -585,7 +585,7 @@ namespace
         class Attributes : public AttributeResolverT<EndpointHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &EndpointHelper::getParent);
                 add("id", &EndpointHelper::getId);
diff --git a/cpp/src/Ice/LoggerI.cpp b/cpp/src/Ice/LoggerI.cpp
index 15448a42429..8c0c7ee8115 100644
--- a/cpp/src/Ice/LoggerI.cpp
+++ b/cpp/src/Ice/LoggerI.cpp
@@ -22,7 +22,7 @@ namespace
     mutex outputMutex;
 
     // Timeout after which rename will be attempted in case of failures renaming files. That is set to 5 minutes.
-    const chrono::minutes retryTimeout = chrono::minutes(5);
+    const chrono::minutes retryTimeout = chrono::minutes(5); // NOLINT:cert-err58-cpp
 }
 
 Ice::LoggerI::LoggerI(string prefix, string file, bool convert, size_t sizeMax)
diff --git a/cpp/src/Ice/MetricsAdminI.cpp b/cpp/src/Ice/MetricsAdminI.cpp
index 44303bc7eaf..2b0b06fd1bb 100644
--- a/cpp/src/Ice/MetricsAdminI.cpp
+++ b/cpp/src/Ice/MetricsAdminI.cpp
@@ -24,6 +24,7 @@ using namespace IceMX;
 namespace
 {
     const string suffixes[] = {
+        // NOLINT:cert-err58-cpp
         "Disabled",
         "GroupBy",
         "Accept.*",
diff --git a/cpp/src/Ice/OpaqueEndpointI.cpp b/cpp/src/Ice/OpaqueEndpointI.cpp
index 0773fc1d00a..d561fc30c95 100644
--- a/cpp/src/Ice/OpaqueEndpointI.cpp
+++ b/cpp/src/Ice/OpaqueEndpointI.cpp
@@ -16,7 +16,7 @@ using namespace IceInternal;
 
 namespace
 {
-    static string opaqueEndpointProtocol = "opaque";
+    static string opaqueEndpointProtocol = "opaque"; // NOLINT:cert-err58-cpp
     static string opaqueEndpointConnectionId;
 }
 
diff --git a/cpp/src/Ice/Reference.h b/cpp/src/Ice/Reference.h
index 029914278c1..641feb77f12 100644
--- a/cpp/src/Ice/Reference.h
+++ b/cpp/src/Ice/Reference.h
@@ -37,11 +37,11 @@ namespace IceInternal
 
         enum Mode
         {
-            ModeTwoway,
-            ModeOneway,
-            ModeBatchOneway,
-            ModeDatagram,
-            ModeBatchDatagram,
+            ModeTwoway = 0,
+            ModeOneway = 1,
+            ModeBatchOneway = 2,
+            ModeDatagram = 3,
+            ModeBatchDatagram = 4,
             ModeLast = ModeBatchDatagram
         };
 
diff --git a/cpp/src/Ice/RegisterPluginsInit.h b/cpp/src/Ice/RegisterPluginsInit.h
index a5d42af8b2b..31a3363f0f8 100644
--- a/cpp/src/Ice/RegisterPluginsInit.h
+++ b/cpp/src/Ice/RegisterPluginsInit.h
@@ -10,7 +10,7 @@ namespace IceInternal
     class RegisterPluginsInit
     {
     public:
-        RegisterPluginsInit();
+        RegisterPluginsInit() noexcept;
     };
 }
 
diff --git a/cpp/src/Ice/RegisterPluginsInit_all.cpp b/cpp/src/Ice/RegisterPluginsInit_all.cpp
index 3ae67fe5d0d..575f8cc2883 100644
--- a/cpp/src/Ice/RegisterPluginsInit_all.cpp
+++ b/cpp/src/Ice/RegisterPluginsInit_all.cpp
@@ -14,7 +14,7 @@ extern "C"
     Ice::Plugin* createIceSSL(const Ice::CommunicatorPtr&, const std::string&, const Ice::StringSeq&);
 }
 
-IceInternal::RegisterPluginsInit::RegisterPluginsInit()
+IceInternal::RegisterPluginsInit::RegisterPluginsInit() noexcept
 {
     Ice::registerPluginFactory("IceTCP", createIceTCP, true);
     Ice::registerPluginFactory("IceSSL", createIceSSL, true);
diff --git a/cpp/src/Ice/RegisterPluginsInit_min.cpp b/cpp/src/Ice/RegisterPluginsInit_min.cpp
index 7e151c34a07..e9261112bc3 100644
--- a/cpp/src/Ice/RegisterPluginsInit_min.cpp
+++ b/cpp/src/Ice/RegisterPluginsInit_min.cpp
@@ -12,7 +12,7 @@ extern "C"
     Ice::Plugin* createIceSSL(const Ice::CommunicatorPtr&, const std::string&, const Ice::StringSeq&);
 }
 
-IceInternal::RegisterPluginsInit::RegisterPluginsInit()
+IceInternal::RegisterPluginsInit::RegisterPluginsInit() noexcept
 {
     Ice::registerPluginFactory("IceTCP", createIceTCP, true);
     Ice::registerPluginFactory("IceSSL", createIceSSL, true);
diff --git a/cpp/src/Ice/SSL/RFC2253.cpp b/cpp/src/Ice/SSL/RFC2253.cpp
index 533f656dc3f..24fb43e746c 100644
--- a/cpp/src/Ice/SSL/RFC2253.cpp
+++ b/cpp/src/Ice/SSL/RFC2253.cpp
@@ -20,8 +20,8 @@ namespace
     // See RFC 2253 and RFC 1779.
     //
 
-    string special = ",=+<>#;";
-    string hexvalid = "0123456789abcdefABCDEF";
+    const string special = ",=+<>#;";                 // NOLINT:cert-err58-cpp
+    const string hexvalid = "0123456789abcdefABCDEF"; // NOLINT:cert-err58-cpp
 }
 
 static char unescapeHex(const string&, size_t);
diff --git a/cpp/src/Ice/Service.cpp b/cpp/src/Ice/Service.cpp
index 93d85c49de4..1dc3c190a40 100644
--- a/cpp/src/Ice/Service.cpp
+++ b/cpp/src/Ice/Service.cpp
@@ -26,7 +26,11 @@ using namespace Ice;
 using namespace IceInternal;
 
 Ice::Service* Ice::Service::_instance = nullptr;
-static CtrlCHandler* _ctrlCHandler = nullptr;
+
+namespace
+{
+    CtrlCHandler* ctrlCHandler = nullptr;
+}
 
 //
 // Callback for CtrlCHandler.
@@ -428,7 +432,7 @@ Ice::Service::Service()
 Ice::Service::~Service()
 {
     _instance = nullptr;
-    delete _ctrlCHandler;
+    delete ctrlCHandler;
 }
 
 bool
@@ -743,7 +747,7 @@ Ice::Service::run(int argc, const char* const argv[], const InitializationData&
         // communicator because we need to ensure that this is done before any
         // additional threads are created.
         //
-        _ctrlCHandler = new CtrlCHandler;
+        ctrlCHandler = new CtrlCHandler;
 
         //
         // Initialize the communicator.
@@ -988,13 +992,13 @@ Ice::Service::print(const string& msg)
 void
 Ice::Service::enableInterrupt()
 {
-    _ctrlCHandler->setCallback(ctrlCHandlerCallback);
+    ctrlCHandler->setCallback(ctrlCHandlerCallback);
 }
 
 void
 Ice::Service::disableInterrupt()
 {
-    _ctrlCHandler->setCallback(nullptr);
+    ctrlCHandler->setCallback(nullptr);
 }
 
 #ifdef _WIN32
@@ -1180,7 +1184,7 @@ Ice::Service::showServiceStatus(const string& msg, SERVICE_STATUS& status)
 void
 Ice::Service::serviceMain(int argc, const wchar_t* const argv[])
 {
-    _ctrlCHandler = new CtrlCHandler;
+    ctrlCHandler = new CtrlCHandler;
 
     //
     // Register the control handler function.
@@ -1558,7 +1562,7 @@ Ice::Service::runDaemon(int argc, char* argv[], const InitializationData& initDa
         // Ignore SIGHUP so that the grandchild process is not sent SIGHUP when this
         // process exits.
         //
-        signal(SIGHUP, SIG_IGN);
+        signal(SIGHUP, SIG_IGN); // NOLINT:cert-err33-c
 
         //
         // Fork again to eliminate the possibility of acquiring a controlling terminal.
@@ -1621,7 +1625,7 @@ Ice::Service::runDaemon(int argc, char* argv[], const InitializationData& initDa
         // communicator thread pools currently use lazy initialization, but a thread can
         // be created to monitor connections.
         //
-        _ctrlCHandler = new CtrlCHandler;
+        ctrlCHandler = new CtrlCHandler;
 
         //
         // Initialize the communicator.
diff --git a/cpp/src/Ice/StringConverter.cpp b/cpp/src/Ice/StringConverter.cpp
index 746be046a75..f4cceff0d7f 100644
--- a/cpp/src/Ice/StringConverter.cpp
+++ b/cpp/src/Ice/StringConverter.cpp
@@ -364,7 +364,7 @@ IceInternal::toUTF16(const vector<uint8_t>& source)
     vector<unsigned short> result;
     if (!source.empty())
     {
-        assert(sizeof(Char16T) == sizeof(unsigned short));
+        static_assert(sizeof(Char16T) == sizeof(unsigned short));
 
         using Convert = wstring_convert<codecvt_utf8_utf16<Char16T>, Char16T>;
 
@@ -394,7 +394,7 @@ IceInternal::toUTF32(const vector<uint8_t>& source)
     vector<unsigned int> result;
     if (!source.empty())
     {
-        assert(sizeof(Char32T) == sizeof(unsigned int));
+        static_assert(sizeof(Char32T) == sizeof(unsigned int));
 
         using Convert = wstring_convert<codecvt_utf8<Char32T>, Char32T>;
         Convert convert;
@@ -423,7 +423,7 @@ IceInternal::fromUTF32(const vector<unsigned int>& source)
     vector<uint8_t> result;
     if (!source.empty())
     {
-        assert(sizeof(Char32T) == sizeof(unsigned int));
+        static_assert(sizeof(Char32T) == sizeof(unsigned int));
 
         using Convert = wstring_convert<codecvt_utf8<Char32T>, Char32T>;
         Convert convert;
diff --git a/cpp/src/Ice/TimeUtil.cpp b/cpp/src/Ice/TimeUtil.cpp
index 6aba4e72bc6..2b1df2e2197 100644
--- a/cpp/src/Ice/TimeUtil.cpp
+++ b/cpp/src/Ice/TimeUtil.cpp
@@ -15,13 +15,19 @@ IceInternal::timePointToString(const chrono::system_clock::time_point& timePoint
     time_t time = static_cast<time_t>(chrono::duration_cast<chrono::seconds>(timePoint.time_since_epoch()).count());
     struct tm tr;
 #ifdef _MSC_VER
-    localtime_s(&tr, &time);
+    auto p = localtime_s(&tr, &time);
 #else
-    localtime_r(&time, &tr);
+    auto p = localtime_r(&time, &tr);
 #endif
-
-    char buf[32];
-    return strftime(buf, sizeof(buf), format.c_str(), &tr) == 0 ? std::string() : std::string(buf);
+    if (p)
+    {
+        char buf[32];
+        return strftime(buf, sizeof(buf), format.c_str(), &tr) == 0 ? std::string{} : std::string{buf};
+    }
+    else
+    {
+        return std::string{};
+    }
 }
 
 string
diff --git a/cpp/src/Ice/WSTransceiver.cpp b/cpp/src/Ice/WSTransceiver.cpp
index f47c282e521..d0b29accf54 100644
--- a/cpp/src/Ice/WSTransceiver.cpp
+++ b/cpp/src/Ice/WSTransceiver.cpp
@@ -52,8 +52,8 @@ using namespace IceInternal;
 
 namespace
 {
-    const string _iceProtocol = "ice.zeroc.com";
-    const string _wsUUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+    const string _iceProtocol = "ice.zeroc.com";                   // NOLINT:cert-err58-cpp
+    const string _wsUUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"; // NOLINT:cert-err58-cpp
 
     //
     // Rename to avoid conflict with OS 10.10 htonll
diff --git a/cpp/src/IceGrid/Database.cpp b/cpp/src/IceGrid/Database.cpp
index 1b72ccf185d..bfaabf1c0bb 100644
--- a/cpp/src/IceGrid/Database.cpp
+++ b/cpp/src/IceGrid/Database.cpp
@@ -31,6 +31,7 @@ using ObjectsMapROCursor = IceDB::ReadOnlyCursor<Ice::Identity, ObjectInfo, IceD
 
 namespace
 {
+    // NOLINTBEGIN:cert-err58-cpp
     const string applicationsDbName = "applications";
     const string adaptersDbName = "adapters";
     const string adaptersByReplicaGroupIdDbName = "adaptersByReplicaGroupId";
@@ -39,6 +40,7 @@ namespace
     const string internalObjectsDbName = "internal-objects";
     const string internalObjectsByTypeDbName = "internal-objectsByType";
     const string serialsDbName = "serials";
+    // NOLINTEND
 
     template<typename K, typename V, typename C, typename H>
     vector<V> toVector(const IceDB::ReadOnlyTxn& txn, const IceDB::Dbi<K, V, C, H>& m)
diff --git a/cpp/src/IceGrid/NodeCache.cpp b/cpp/src/IceGrid/NodeCache.cpp
index 2efe8e259f4..b5d01481141 100644
--- a/cpp/src/IceGrid/NodeCache.cpp
+++ b/cpp/src/IceGrid/NodeCache.cpp
@@ -267,7 +267,7 @@ NodeEntry::getLoadInfoAndLoadFactor(const string& application, float& loadFactor
             // machine is the same as a load of 1 on a single process
             // machine.
             //
-            loadFactor = 1.0f / _session->getInfo()->nProcessors;
+            loadFactor = 1.0f / static_cast<float>(_session->getInfo()->nProcessors);
         }
         else
         {
diff --git a/cpp/src/IceGrid/NodeSessionI.cpp b/cpp/src/IceGrid/NodeSessionI.cpp
index 9c423dfdc43..6d793333d5e 100644
--- a/cpp/src/IceGrid/NodeSessionI.cpp
+++ b/cpp/src/IceGrid/NodeSessionI.cpp
@@ -210,7 +210,7 @@ NodeSessionI::getNode() const
 }
 
 const shared_ptr<InternalNodeInfo>&
-NodeSessionI::getInfo() const
+NodeSessionI::getInfo() const noexcept
 {
     return _info;
 }
diff --git a/cpp/src/IceGrid/NodeSessionI.h b/cpp/src/IceGrid/NodeSessionI.h
index 1256fe05d59..c17ddf156c9 100644
--- a/cpp/src/IceGrid/NodeSessionI.h
+++ b/cpp/src/IceGrid/NodeSessionI.h
@@ -42,7 +42,7 @@ namespace IceGrid
         void shutdown();
 
         const NodePrx& getNode() const;
-        const std::shared_ptr<InternalNodeInfo>& getInfo() const;
+        const std::shared_ptr<InternalNodeInfo>& getInfo() const noexcept;
         const LoadInfo& getLoadInfo() const;
         NodeSessionPrx getProxy() const;
 
diff --git a/cpp/src/IceGrid/PluginFacadeI.cpp b/cpp/src/IceGrid/PluginFacadeI.cpp
index 983a35b6e4d..d19806bc8aa 100644
--- a/cpp/src/IceGrid/PluginFacadeI.cpp
+++ b/cpp/src/IceGrid/PluginFacadeI.cpp
@@ -20,7 +20,7 @@ namespace
     class Init
     {
     public:
-        Init() { IceGrid::setRegistryPluginFacade(make_shared<RegistryPluginFacadeI>()); }
+        Init() noexcept { IceGrid::setRegistryPluginFacade(make_shared<RegistryPluginFacadeI>()); }
 
         ~Init() { IceGrid::setRegistryPluginFacade(nullptr); }
     };
diff --git a/cpp/src/IceGrid/TraceLevels.h b/cpp/src/IceGrid/TraceLevels.h
index 847a3561874..61841dee8e6 100644
--- a/cpp/src/IceGrid/TraceLevels.h
+++ b/cpp/src/IceGrid/TraceLevels.h
@@ -10,7 +10,7 @@
 
 namespace IceGrid
 {
-    class TraceLevels
+    class TraceLevels // NOLINT:clang-analyzer-optin.performance.Padding
     {
     public:
         TraceLevels(const Ice::CommunicatorPtr&, const std::string&);
diff --git a/cpp/src/IceStorm/InstrumentationI.cpp b/cpp/src/IceStorm/InstrumentationI.cpp
index c901828726a..fa7827b22ce 100644
--- a/cpp/src/IceStorm/InstrumentationI.cpp
+++ b/cpp/src/IceStorm/InstrumentationI.cpp
@@ -22,7 +22,7 @@ namespace
         class Attributes : public AttributeResolverT<TopicHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &TopicHelper::getService);
                 add("id", &TopicHelper::getId);
@@ -53,7 +53,7 @@ namespace
         class Attributes : public AttributeResolverT<SubscriberHelper>
         {
         public:
-            Attributes()
+            Attributes() noexcept
             {
                 add("parent", &SubscriberHelper::getTopic);
                 add("id", &SubscriberHelper::getId);
diff --git a/cpp/src/IceStorm/NodeI.h b/cpp/src/IceStorm/NodeI.h
index 2d735ec0d7f..58713197f7c 100644
--- a/cpp/src/IceStorm/NodeI.h
+++ b/cpp/src/IceStorm/NodeI.h
@@ -144,7 +144,7 @@ namespace IceStormElection
     private:
         const std::shared_ptr<NodeI> _node;
         std::optional<Ice::ObjectPrx> _master;
-        std::int64_t _generation;
+        std::int64_t _generation{-1};
     };
 
     class ObserverUpdateHelper
diff --git a/cpp/src/IceStorm/TraceLevels.h b/cpp/src/IceStorm/TraceLevels.h
index cdd20b6098e..46d318b8e4b 100644
--- a/cpp/src/IceStorm/TraceLevels.h
+++ b/cpp/src/IceStorm/TraceLevels.h
@@ -12,7 +12,7 @@
 
 namespace IceStorm
 {
-    class TraceLevels
+    class TraceLevels // NOLINT:clang-analyzer-optin.performance.Padding
     {
     public:
         TraceLevels(const Ice::PropertiesPtr&, Ice::LoggerPtr);
diff --git a/cpp/src/IceStorm/Util.h b/cpp/src/IceStorm/Util.h
index 3f4d940c2a3..74dfc36f2aa 100644
--- a/cpp/src/IceStorm/Util.h
+++ b/cpp/src/IceStorm/Util.h
@@ -21,7 +21,7 @@ namespace IceStorm
         IceDB::Dbi<IceStorm::SubscriberRecordKey, IceStorm::SubscriberRecord, IceDB::IceContext, Ice::OutputStream>;
     using LLUMap = IceDB::Dbi<std::string, IceStormElection::LogUpdate, IceDB::IceContext, Ice::OutputStream>;
 
-    const std::string lluDbKey = "_manager";
+    const char* const lluDbKey = "_manager";
 }
 
 namespace IceStormInternal
diff --git a/cpp/src/Slice/Parser.h b/cpp/src/Slice/Parser.h
index 8a77eee8c39..df09122c1e9 100644
--- a/cpp/src/Slice/Parser.h
+++ b/cpp/src/Slice/Parser.h
@@ -347,6 +347,7 @@ namespace Slice
         std::string kindAsString() const;
         static std::optional<Kind> kindFromString(std::string_view str);
 
+        // NOLINTNEXTLINE:cert-err58-cpp
         inline static const std::array<std::string, 11> builtinTable =
             {"byte", "bool", "short", "int", "long", "float", "double", "string", "Object", "Object*", "Value"};
 
diff --git a/cpp/src/slice2cpp/CPlusPlusUtil.cpp b/cpp/src/slice2cpp/CPlusPlusUtil.cpp
index 07a1d5f44fc..84a405233ed 100644
--- a/cpp/src/slice2cpp/CPlusPlusUtil.cpp
+++ b/cpp/src/slice2cpp/CPlusPlusUtil.cpp
@@ -355,7 +355,7 @@ namespace
     }
 }
 
-string Slice::paramPrefix = "iceP_";
+string Slice::paramPrefix = "iceP_"; // NOLINT:cert-err58-cpp
 
 char
 Slice::ToIfdef::operator()(char c)
diff --git a/cpp/src/slice2py/Python.cpp b/cpp/src/slice2py/Python.cpp
index 4e99c079ab7..189994cbc83 100644
--- a/cpp/src/slice2py/Python.cpp
+++ b/cpp/src/slice2py/Python.cpp
@@ -185,8 +185,8 @@ namespace
         StringList& _modules;
     };
 
-    const string moduleTag = "# Modules:";
-    const string submoduleTag = "# Submodules:";
+    const string moduleTag = "# Modules:";       // NOLINT:cert-err58-cpp
+    const string submoduleTag = "# Submodules:"; // NOLINT:cert-err58-cpp
 
     PackageVisitor::PackageVisitor(StringList& modules) : _modules(modules) {}
 
diff --git a/cpp/src/slice2py/PythonUtil.cpp b/cpp/src/slice2py/PythonUtil.cpp
index 5078e46b808..0244dbc31d8 100644
--- a/cpp/src/slice2py/PythonUtil.cpp
+++ b/cpp/src/slice2py/PythonUtil.cpp
@@ -31,7 +31,7 @@ namespace
         return name;
     }
 
-    const string tripleQuotes = "\"\"\"";
+    const char* const tripleQuotes = "\"\"\"";
 
     string typeToDocstring(const TypePtr& type, bool optional)
     {
diff --git a/cpp/test/Ice/invoke/AllTests.cpp b/cpp/test/Ice/invoke/AllTests.cpp
index 080091e3a06..37afc8e4285 100644
--- a/cpp/test/Ice/invoke/AllTests.cpp
+++ b/cpp/test/Ice/invoke/AllTests.cpp
@@ -10,11 +10,11 @@ using namespace std;
 using namespace Ice;
 using namespace Test;
 
-static string testString = "This is a test string";
-
 Test::MyClassPrx
 allTests(Test::TestHelper* helper)
 {
+    static const string testString = "This is a test string";
+
     CommunicatorPtr communicator = helper->communicator();
     Test::MyClassPrx cl(communicator, "test:" + helper->getTestEndpoint());
     Test::MyClassPrx oneway = cl->ice_oneway();
diff --git a/cpp/test/Ice/logger/Client5.cpp b/cpp/test/Ice/logger/Client5.cpp
index f81d9a0eb19..472385ae67e 100644
--- a/cpp/test/Ice/logger/Client5.cpp
+++ b/cpp/test/Ice/logger/Client5.cpp
@@ -25,11 +25,11 @@ runTest(const Ice::CommunicatorPtr& communicator)
 // byte for the line end \n and that makes a total of 128 bytes.
 //
 #ifdef _WIN32
-const string message = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
-                       "Vestibulum ornare, ex non bibendum hendrerit, felis tortor cras amet.";
+const char* const message = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
+                            "Vestibulum ornare, ex non bibendum hendrerit, felis tortor cras amet.";
 #else
-const string message = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
-                       "Fusce dictum turpis ante, sit amet finibus eros commodo vel. Sed amet.";
+const char* const message = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. "
+                            "Fusce dictum turpis ante, sit amet finibus eros commodo vel. Sed amet.";
 #endif
 
 class Client5 : public Test::TestHelper
diff --git a/cpp/test/Ice/retry/InstrumentationI.cpp b/cpp/test/Ice/retry/InstrumentationI.cpp
index 0bd1537458d..6ec8494cd9d 100644
--- a/cpp/test/Ice/retry/InstrumentationI.cpp
+++ b/cpp/test/Ice/retry/InstrumentationI.cpp
@@ -56,6 +56,7 @@ namespace
         }
     };
 
+    // NOLINTNEXTLINE:cert-err58-cpp
     Instrumentation::InvocationObserverPtr invocationObserver = make_shared<InvocationObserverI>();
 
     class CommunicatorObserverI final : public Instrumentation::CommunicatorObserver
@@ -97,6 +98,7 @@ namespace
         void setObserverUpdater(const Instrumentation::ObserverUpdaterPtr&) final {}
     };
 
+    // NOLINTNEXTLINE:cert-err58-cpp
     Instrumentation::CommunicatorObserverPtr communicatorObserver = make_shared<CommunicatorObserverI>();
 
     void testEqual(int& value, int expected)
diff --git a/cpp/test/IceBridge/simple/TestI.cpp b/cpp/test/IceBridge/simple/TestI.cpp
index 8dd11109185..fdc0e0ec48a 100644
--- a/cpp/test/IceBridge/simple/TestI.cpp
+++ b/cpp/test/IceBridge/simple/TestI.cpp
@@ -11,7 +11,7 @@ using namespace Test;
 
 namespace
 {
-    Ice::Identity callbackId = {"callback", ""};
+    Ice::Identity callbackId{"callback", ""}; // NOLINT:cert-err58-cpp
 }
 
 void
diff --git a/cpp/test/IceGrid/replication/AllTests.cpp b/cpp/test/IceGrid/replication/AllTests.cpp
index aa775610d4f..d218beb88c6 100644
--- a/cpp/test/IceGrid/replication/AllTests.cpp
+++ b/cpp/test/IceGrid/replication/AllTests.cpp
@@ -17,8 +17,10 @@ using namespace IceGrid;
 
 namespace
 {
+    // NOLINTBEGIN:cert-err58-cpp
     const auto sleepTime = 100ms;
     const int maxRetry = static_cast<int>(120000 / sleepTime.count()); // 2 minutes
+    // NOLINTEND
 
     void waitForServerState(const optional<AdminPrx>& admin, const string& server, bool up)
     {
diff --git a/cpp/test/IceSSL/configuration/SecureTransportTests.cpp b/cpp/test/IceSSL/configuration/SecureTransportTests.cpp
index bf2ee34f3b6..03f12c04bee 100644
--- a/cpp/test/IceSSL/configuration/SecureTransportTests.cpp
+++ b/cpp/test/IceSSL/configuration/SecureTransportTests.cpp
@@ -50,8 +50,8 @@ getResourcePath(const string& path)
 }
 #    endif
 
-const string password = "password";
-const string keychainPassword = "password";
+const char* const password = "password";
+const char* const keychainPassword = "password";
 
 Ice::CommunicatorPtr
 createServer(ServerAuthenticationOptions serverAuthenticationOptions, TestHelper* helper)
diff --git a/cpp/test/IceUtil/uuid/Client.cpp b/cpp/test/IceUtil/uuid/Client.cpp
index ed729f46de5..ce78f78ff77 100644
--- a/cpp/test/IceUtil/uuid/Client.cpp
+++ b/cpp/test/IceUtil/uuid/Client.cpp
@@ -143,8 +143,9 @@ runTest(int threadCount, GenerateFunc func, long howMany, bool verbose, string n
     if (verbose)
     {
         cout << "Each " << name << " took an average of "
-             << (double)(chrono::duration_cast<chrono::microseconds>(finish - start).count()) / howMany
-             << " micro seconds to generate and insert into a set." << endl;
+             << static_cast<double>(chrono::duration_cast<chrono::microseconds>(finish - start).count()) /
+                    static_cast<double>(howMany)
+             << " microseconds to generate and insert into a set." << endl;
     }
 }