diff --git a/connectivity/FEATURE_BLE/source/Gap.cpp b/connectivity/FEATURE_BLE/source/Gap.cpp
index 51a02ddeb0..727d2a285c 100644
--- a/connectivity/FEATURE_BLE/source/Gap.cpp
+++ b/connectivity/FEATURE_BLE/source/Gap.cpp
@@ -285,14 +285,6 @@ ble_error_t Gap::cancelConnect()
 }
 
 
-ble_error_t Gap::cancelConnect(
-    peer_address_type_t peerAddressType,
-    const address_t &peerAddress
-)
-{
-    return impl->cancelConnect(peerAddressType, peerAddress);
-}
-
 #endif // BLE_ROLE_CENTRAL
 
 #if BLE_FEATURE_CONNECTABLE
diff --git a/connectivity/FEATURE_BLE/source/generic/GapImpl.cpp b/connectivity/FEATURE_BLE/source/generic/GapImpl.cpp
index b308dad4aa..deca453fd2 100644
--- a/connectivity/FEATURE_BLE/source/generic/GapImpl.cpp
+++ b/connectivity/FEATURE_BLE/source/generic/GapImpl.cpp
@@ -17,21 +17,20 @@
  */
 
 #include <algorithm>
-#include <stdint.h>
+#include <cstdint>
 
-#include "GapImpl.h"
-#include "ble/Gap.h"
-#include "source/BLEInstanceBase.h"
 #include "ble/Gap.h"
 #include "ble/SecurityManager.h"
+
+#include "source/BLEInstanceBase.h"
+#include "source/generic/GapImpl.h"
+
 #include "source/pal/PalGap.h"
 #include "source/pal/GapEvents.h"
 #include "source/pal/GapTypes.h"
 #include "source/pal/PalGenericAccessService.h"
 #include "source/pal/PalEventQueue.h"
-#include "source/pal/PalGap.h"
 
-#include "drivers/Timeout.h"
 
 using namespace std::chrono;
 
@@ -44,21 +43,21 @@ namespace impl {
 namespace {
 
 // Constants
-static const uint16_t scan_interval_min = 0x0004;
-static const uint16_t scan_interval_max = 0x4000;
-static const uint16_t connection_interval_min = 0x0006;
-static const uint16_t connection_interval_max = 0x0C80;
-static const uint16_t slave_latency_min = 0x0000;
-static const uint16_t slave_latency_max = 0x01F3;
-static const uint16_t advertising_interval_min = 0x0020;
-static const uint16_t advertising_interval_max = 0x4000;
-static const uint16_t supervision_timeout_min = 0x000A;
-static const uint16_t supervision_timeout_max = 0x0C80;
+const uint16_t scan_interval_min = 0x0004;
+const uint16_t scan_interval_max = 0x4000;
+const uint16_t connection_interval_min = 0x0006;
+const uint16_t connection_interval_max = 0x0C80;
+const uint16_t slave_latency_min = 0x0000;
+const uint16_t slave_latency_max = 0x01F3;
+const uint16_t advertising_interval_min = 0x0020;
+const uint16_t advertising_interval_max = 0x4000;
+const uint16_t supervision_timeout_min = 0x000A;
+const uint16_t supervision_timeout_max = 0x0C80;
 
-static const mbed_error_status_t mixed_scan_api_error =
+const mbed_error_status_t mixed_scan_api_error =
     MBED_MAKE_ERROR(MBED_MODULE_BLE, MBED_ERROR_CODE_BLE_USE_INCOMPATIBLE_API);
 
-static const mbed_error_status_t illegal_state_error =
+const mbed_error_status_t illegal_state_error =
     MBED_MAKE_ERROR(MBED_MODULE_BLE, MBED_ERROR_CODE_BLE_ILLEGAL_STATE);
 
 /*
@@ -82,13 +81,13 @@ static bool is_in_range(T value, T lower_bound, T higher_bound)
  * timeout to be equal to 0xFFFF. When it is the case that value can be
  * interpreted as "non specific".
  */
-static bool is_preferred_connection_params_valid(const Gap::PreferredConnectionParams_t *params)
+bool is_preferred_connection_params_valid(const Gap::PreferredConnectionParams_t *params)
 {
     if (params == nullptr) {
         return false;
     }
 
-    if (is_in_range(params->slaveLatency, slave_latency_min, slave_latency_max) == false) {
+    if (!is_in_range(params->slaveLatency, slave_latency_min, slave_latency_max) == false) {
         return false;
     }
 
@@ -132,7 +131,7 @@ static bool is_preferred_connection_params_valid(const Gap::PreferredConnectionP
 /**
  * Check if random bytes of an address are valid.
  */
-static bool is_prand_valid(const uint8_t *bytes, size_t len)
+bool is_prand_valid(const uint8_t *bytes, size_t len)
 {
     // at least one bit of the random part of the static address shall be
     // equal to 0 and at least one bit of the random part of the static
@@ -163,7 +162,7 @@ static bool is_prand_valid(const uint8_t *bytes, size_t len)
  * or not.
  * Return true if it is the case and false otherwise.
  */
-static bool is_prand_48_bits_valid(const address_t &address)
+bool is_prand_48_bits_valid(const address_t &address)
 {
     return is_prand_valid(address.data(), 6);
 }
@@ -173,7 +172,7 @@ static bool is_prand_48_bits_valid(const address_t &address)
  * or not.
  * Return true if it is the case and false otherwise.
  */
-static bool is_prand_24_bits_valid(const address_t &address)
+bool is_prand_24_bits_valid(const address_t &address)
 {
     return is_prand_valid(address.data() + 3, 3);
 }
@@ -181,7 +180,7 @@ static bool is_prand_24_bits_valid(const address_t &address)
 /*
  * Return true if address is a random static address.
  */
-static bool is_random_static_address(const address_t &address)
+bool is_random_static_address(const address_t &address)
 {
     // top two msb bits shall be equal to 0b11.
     if ((address[5] & 0xC0) != 0xC0) {
@@ -194,7 +193,7 @@ static bool is_random_static_address(const address_t &address)
 /*
  * Return true if address is a random private non resolvable address.
  */
-static bool is_random_private_non_resolvable_address(
+bool is_random_private_non_resolvable_address(
     const address_t &address
 )
 {
@@ -209,7 +208,7 @@ static bool is_random_private_non_resolvable_address(
 /*
  * Return true if address is a random private resolvable address.
  */
-static bool is_random_private_resolvable_address(
+bool is_random_private_resolvable_address(
     const address_t &address
 )
 {
@@ -224,7 +223,7 @@ static bool is_random_private_resolvable_address(
 /*
  * Return true if the address is a random address.
  */
-static bool is_random_address(const address_t &address)
+bool is_random_address(const address_t &address)
 {
     return is_random_private_resolvable_address(address) ||
         is_random_private_non_resolvable_address(address) ||
@@ -234,7 +233,7 @@ static bool is_random_address(const address_t &address)
 /*
  * Return true if the whitelist in input is valid or false otherwise.
  */
-static bool is_whitelist_valid(const ::ble::whitelist_t &whitelist)
+bool is_whitelist_valid(const ::ble::whitelist_t &whitelist)
 {
     if (whitelist.size > whitelist.capacity) {
         return false;
@@ -266,7 +265,7 @@ static bool is_whitelist_valid(const ::ble::whitelist_t &whitelist)
 /*
  * Return true if device is present in the whitelist.
  */
-static bool is_in_whitelist(
+bool is_in_whitelist(
     const whitelist_t::entry_t &device, const whitelist_t &whitelist
 )
 {
@@ -283,7 +282,7 @@ static bool is_in_whitelist(
 /*
  * Convert a peer_address_type_t into a whitelist_address_type_t.
  */
-static whitelist_address_type_t to_whitelist_address_type(
+whitelist_address_type_t to_whitelist_address_type(
     peer_address_type_t address_type
 )
 {
@@ -354,9 +353,7 @@ Gap::Gap(
 }
 
 
-Gap::~Gap()
-{
-}
+Gap::~Gap() = default;
 
 
 bool Gap::isFeatureSupported(controller_supported_features_t feature)
@@ -907,7 +904,7 @@ ble_error_t Gap::getCentralPrivacyConfiguration(
 }
 
 
-ble_error_t Gap::reset(void)
+ble_error_t Gap::reset()
 {
     /* Notify that the instance is about to shut down */
 //    shutdownCallChain.call(this);
@@ -973,6 +970,16 @@ ble_error_t Gap::reset(void)
     return BLE_ERROR_NONE;
 }
 
+void Gap::onShutdown(const GapShutdownCallback_t &callback)
+{
+    shutdownCallChain.add(callback);
+}
+
+Gap::GapShutdownCallbackChain_t &Gap::onShutdown()
+{
+    return shutdownCallChain;
+}
+
 
 void Gap::on_scan_timeout()
 {
diff --git a/connectivity/FEATURE_BLE/source/generic/GapImpl.h b/connectivity/FEATURE_BLE/source/generic/GapImpl.h
index 87f5579ce3..cd204a95f7 100644
--- a/connectivity/FEATURE_BLE/source/generic/GapImpl.h
+++ b/connectivity/FEATURE_BLE/source/generic/GapImpl.h
@@ -312,7 +312,7 @@ public:
 
 #if BLE_FEATURE_WHITELIST
 
-    uint8_t getMaxWhitelistSize(void) const;
+    uint8_t getMaxWhitelistSize() const;
 
     ble_error_t getWhitelist(whitelist_t &whitelist) const;
 
@@ -326,17 +326,14 @@ public:
     );
 
     static ble_error_t getRandomAddressType(
-        const ble::address_t address,
+        ble::address_t address,
         ble::random_address_type_t *addressType
     );
 
-    ble_error_t reset(void);
+    ble_error_t reset();
 
     void onShutdown(const GapShutdownCallback_t &callback);
 
-    template<typename T>
-    void onShutdown(T *objPtr, void (T::*memberPtr)(const Gap *));
-
     GapShutdownCallbackChain_t &onShutdown();
 
 #if !defined(DOXYGEN_ONLY)
@@ -432,20 +429,20 @@ private:
         connection_handle_t connection_handle,
         phy_t tx_phy,
         phy_t rx_phy
-    );
+    ) override;
 
     void on_data_length_change(
         connection_handle_t connection_handle,
         uint16_t tx_size,
         uint16_t rx_size
-    );
+    ) override;
 
     void on_phy_update_complete(
         hci_error_code_t hci_status,
         connection_handle_t connection_handle,
         phy_t tx_phy,
         phy_t rx_phy
-    );
+    ) override;
 
     void on_enhanced_connection_complete(
         hci_error_code_t status,
@@ -459,7 +456,7 @@ private:
         uint16_t connection_latency,
         uint16_t supervision_timeout,
         clock_accuracy_t master_clock_accuracy
-    );
+    ) override;
 
     void on_extended_advertising_report(
         advertising_event_t event_type,
@@ -475,7 +472,7 @@ private:
         const ble::address_t &direct_address,
         uint8_t data_length,
         const uint8_t *data
-    );
+    ) override;
 
     void on_periodic_advertising_sync_established(
         hci_error_code_t error,
@@ -486,7 +483,7 @@ private:
         phy_t advertiser_phy,
         uint16_t periodic_advertising_interval,
         clock_accuracy_t clock_accuracy
-    );
+    ) override;
 
     void on_periodic_advertising_report(
         sync_handle_t sync_handle,
@@ -495,22 +492,22 @@ private:
         advertising_data_status_t data_status,
         uint8_t data_length,
         const uint8_t *data
-    );
+    ) override;
 
-    void on_periodic_advertising_sync_loss(sync_handle_t sync_handle);
+    void on_periodic_advertising_sync_loss(sync_handle_t sync_handle) override;
 
     void on_advertising_set_terminated(
         hci_error_code_t status,
         advertising_handle_t advertising_handle,
         connection_handle_t connection_handle,
         uint8_t number_of_completed_extended_advertising_events
-    );
+    ) override;
 
     void on_scan_request_received(
         advertising_handle_t advertising_handle,
         connection_peer_address_type_t scanner_address_type,
         const ble::address_t &address
-    );
+    ) override;
 
     void on_connection_update_complete(
         hci_error_code_t status,
@@ -518,7 +515,7 @@ private:
         uint16_t connection_interval,
         uint16_t connection_latency,
         uint16_t supervision_timeout
-    );
+    ) override;
 
     void on_remote_connection_parameter(
         connection_handle_t connection_handle,
@@ -526,9 +523,9 @@ private:
         uint16_t connection_interval_max,
         uint16_t connection_latency,
         uint16_t supervision_timeout
-    );
+    ) override;
 
-    void on_scan_timeout();
+    void on_scan_timeout() override;
 
     void process_legacy_scan_timeout();
 
diff --git a/connectivity/FEATURE_BLE/source/generic/GattClientImpl.cpp b/connectivity/FEATURE_BLE/source/generic/GattClientImpl.cpp
index 70f1224b44..d23ef95284 100644
--- a/connectivity/FEATURE_BLE/source/generic/GattClientImpl.cpp
+++ b/connectivity/FEATURE_BLE/source/generic/GattClientImpl.cpp
@@ -20,17 +20,17 @@
 
 #if BLE_FEATURE_GATT_CLIENT
 
-#include <stdio.h>
-#include <stdlib.h>
+#include <cstdlib>
+#include <algorithm>
 
-#include "GattClientImpl.h"
-#include "source/pal/AttServerMessage.h"
+#include "ble/SecurityManager.h"
 #include "ble/gatt/DiscoveredService.h"
 #include "ble/gatt/DiscoveredCharacteristic.h"
 #include "ble/common/blecommon.h"
+
+#include "source/generic/GattClientImpl.h"
+#include "source/pal/AttServerMessage.h"
 #include "source/BLEInstanceBase.h"
-#include "ble/SecurityManager.h"
-#include <algorithm>
 
 using ble::AttServerMessage;
 using ble::AttReadResponse;
@@ -86,9 +86,7 @@ struct GattClient::ProcedureControlBlock {
     {
     }
 
-    virtual ~ProcedureControlBlock()
-    {
-    }
+    virtual ~ProcedureControlBlock() = default;
 
     /*
      * Entry point of the control block stack machine.
@@ -115,7 +113,7 @@ struct GattClient::ProcedureControlBlock {
  * Procedure control block for the discovery process.
  */
 
-struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
+struct GattClient::DiscoveryControlBlock final : public ProcedureControlBlock {
     using ProcedureControlBlock::connection_handle;
 
     DiscoveryControlBlock(
@@ -134,7 +132,7 @@ struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
     {
     }
 
-    virtual ~DiscoveryControlBlock()
+    ~DiscoveryControlBlock() final
     {
         while (services_discovered) {
             service_t *tmp = services_discovered->next;
@@ -143,17 +141,17 @@ struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
         }
     }
 
-    virtual void handle_timeout_error(GattClient *client)
+    void handle_timeout_error(GattClient *client)  final
     {
         terminate(client);
     }
 
-    virtual void abort(GattClient *client)
+    void abort(GattClient *client) final
     {
         terminate(client);
     }
 
-    virtual void handle(GattClient *client, const AttServerMessage &message)
+    void handle(GattClient *client, const AttServerMessage &message) final
     {
         // if end of discovery has been requested, ends it immediately
         if (done) {
@@ -178,7 +176,7 @@ struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
                 );
                 break;
             case AttributeOpcode::ERROR_RESPONSE: {
-                const AttErrorResponse &error = static_cast<const AttErrorResponse &>(message);
+                const auto &error = static_cast<const AttErrorResponse &>(message);
                 if (error.error_code != AttErrorResponse::ATTRIBUTE_NOT_FOUND) {
                     terminate(client);
                     return;
@@ -222,7 +220,7 @@ struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
                 discovered_service.setup(uuid, start_handle, end_handle);
                 service_callback(&discovered_service);
             } else {
-                service_t *discovered_service = new(std::nothrow) service_t(
+                auto *discovered_service = new(std::nothrow) service_t(
                     start_handle, end_handle, uuid
                 );
 
@@ -475,7 +473,7 @@ struct GattClient::DiscoveryControlBlock : public ProcedureControlBlock {
 };
 
 
-struct GattClient::ReadControlBlock : public ProcedureControlBlock {
+struct GattClient::ReadControlBlock final : public ProcedureControlBlock {
     using ProcedureControlBlock::connection_handle;
 
     ReadControlBlock(
@@ -486,14 +484,14 @@ struct GattClient::ReadControlBlock : public ProcedureControlBlock {
     {
     }
 
-    virtual ~ReadControlBlock()
+    ~ReadControlBlock() final
     {
         if (data != nullptr) {
             free(data);
         }
     }
 
-    virtual void handle_timeout_error(GattClient *client)
+    void handle_timeout_error(GattClient *client) final
     {
         GattReadCallbackParams response = {
             connection_handle,
@@ -506,7 +504,7 @@ struct GattClient::ReadControlBlock : public ProcedureControlBlock {
         terminate(client, response);
     }
 
-    virtual void abort(GattClient *client)
+    void abort(GattClient *client) final
     {
         GattReadCallbackParams response = {
             connection_handle,
@@ -526,7 +524,7 @@ struct GattClient::ReadControlBlock : public ProcedureControlBlock {
         delete this;
     }
 
-    virtual void handle(GattClient *client, const AttServerMessage &message)
+    void handle(GattClient *client, const AttServerMessage &message) final
     {
         switch (message.opcode) {
             case AttributeOpcode::ERROR_RESPONSE:
@@ -679,7 +677,7 @@ struct GattClient::ReadControlBlock : public ProcedureControlBlock {
  * Control block for the write process
  */
 
-struct GattClient::WriteControlBlock : public ProcedureControlBlock {
+struct GattClient::WriteControlBlock final : public ProcedureControlBlock {
     using ProcedureControlBlock::connection_handle;
 
     WriteControlBlock(
@@ -693,12 +691,12 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
     {
     }
 
-    virtual ~WriteControlBlock() 
+    ~WriteControlBlock() final
     {
         free(data);
     }
 
-    virtual void handle_timeout_error(GattClient* client) 
+    void handle_timeout_error(GattClient *client) final
     {
         GattWriteCallbackParams response = {
             connection_handle,
@@ -710,7 +708,7 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
         terminate(client, response);
     }
 
-    virtual void abort(GattClient *client)
+    void abort(GattClient *client) final
     {
         GattWriteCallbackParams response = {
             connection_handle,
@@ -729,7 +727,7 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
         delete this;
     }
 
-    virtual void handle(GattClient* client, const AttServerMessage& message) 
+    void handle(GattClient *client, const AttServerMessage &message) final
     {
         switch(message.opcode) {
             case AttributeOpcode::ERROR_RESPONSE:
@@ -814,7 +812,7 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
             connection_handle,
             attribute_handle,
             GattWriteCallbackParams::OP_WRITE_REQ,
-            status,
+            static_cast<uint16_t>(status),
             error_code
         };
 
@@ -849,20 +847,12 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
 
         switch (error.error_code) {
             case AttErrorResponse::INVALID_HANDLE:
-                status = BLE_ERROR_INVALID_PARAM;
-                break;
             case AttErrorResponse::INVALID_ATTRIBUTE_VALUE_LENGTH:
                 status = BLE_ERROR_INVALID_PARAM;
                 break;
             case AttErrorResponse::INSUFFICIENT_AUTHORIZATION:
-                status = BLE_ERROR_INVALID_STATE;
-                break;
             case AttErrorResponse::INSUFFICIENT_AUTHENTICATION:
-                status = BLE_ERROR_INVALID_STATE;
-                break;
             case AttErrorResponse::INSUFFICIENT_ENCRYPTION_KEY_SIZE:
-                status = BLE_ERROR_INVALID_STATE;
-                break;
             case AttErrorResponse::INSUFFICIENT_ENCRYPTION:
                 status = BLE_ERROR_INVALID_STATE;
                 break;
@@ -902,7 +892,7 @@ struct GattClient::WriteControlBlock : public ProcedureControlBlock {
  * Control block for the descriptor discovery process
  */
 
-struct GattClient::DescriptorDiscoveryControlBlock : public ProcedureControlBlock {
+struct GattClient::DescriptorDiscoveryControlBlock final : public ProcedureControlBlock {
     using ProcedureControlBlock::connection_handle;
 
     DescriptorDiscoveryControlBlock(
@@ -918,9 +908,7 @@ struct GattClient::DescriptorDiscoveryControlBlock : public ProcedureControlBloc
     {
     }
 
-    virtual ~DescriptorDiscoveryControlBlock()
-    {
-    }
+    ~DescriptorDiscoveryControlBlock() final = default;
 
     ble_error_t start(GattClient *client)
     {
@@ -933,17 +921,17 @@ struct GattClient::DescriptorDiscoveryControlBlock : public ProcedureControlBloc
         );
     }
 
-    virtual void handle_timeout_error(GattClient *client)
+    void handle_timeout_error(GattClient *client) final
     {
         terminate(client, BLE_ERROR_UNSPECIFIED);
     }
 
-    virtual void abort(GattClient *client)
+    void abort(GattClient *client) final
     {
         terminate(client, BLE_ERROR_INVALID_STATE);
     }
 
-    virtual void handle(GattClient *client, const AttServerMessage &message)
+    void handle(GattClient *client, const AttServerMessage &message) final
     {
         if (done) {
             terminate(client, BLE_ERROR_NONE);
@@ -1061,7 +1049,7 @@ ble_error_t GattClient::launchServiceDiscovery(
         return BLE_ERROR_NONE;
     }
 
-    DiscoveryControlBlock *discovery_pcb = new(std::nothrow) DiscoveryControlBlock(
+    auto *discovery_pcb = new(std::nothrow) DiscoveryControlBlock(
         connection_handle,
         service_callback,
         characteristic_callback,
@@ -1154,7 +1142,7 @@ ble_error_t GattClient::read(
         return BLE_ERROR_INVALID_STATE;
     }
 
-    ReadControlBlock *read_pcb = new(std::nothrow) ReadControlBlock(
+    auto *read_pcb = new(std::nothrow) ReadControlBlock(
         connection_handle,
         attribute_handle,
         offset
@@ -1253,7 +1241,7 @@ ble_error_t GattClient::write(
             memcpy(data, value, length);
         }
 
-        WriteControlBlock *write_pcb = new(std::nothrow) WriteControlBlock(
+        auto *write_pcb = new(std::nothrow) WriteControlBlock(
             connection_handle,
             attribute_handle,
             data,
@@ -1325,7 +1313,7 @@ ble_error_t GattClient::discoverCharacteristicDescriptors(
         return BLE_ERROR_NONE;
     }
 
-    DescriptorDiscoveryControlBlock *discovery_pcb =
+    auto *discovery_pcb =
         new(std::nothrow) DescriptorDiscoveryControlBlock(
             characteristic,
             discoveryCallback,
@@ -1375,8 +1363,7 @@ void GattClient::terminateCharacteristicDescriptorDiscovery(
 
     while (pcb) {
         if (pcb->type == DESCRIPTOR_DISCOVERY_PROCEDURE) {
-            DescriptorDiscoveryControlBlock *dpcb =
-                static_cast<DescriptorDiscoveryControlBlock *>(pcb);
+            auto *dpcb = static_cast<DescriptorDiscoveryControlBlock *>(pcb);
             if (dpcb->characteristic == characteristic) {
                 dpcb->done = true;
                 return;
@@ -1397,7 +1384,7 @@ ble_error_t GattClient::negotiateAttMtu(
 }
 
 
-ble_error_t GattClient::reset(void)
+ble_error_t GattClient::reset()
 {
     /* Notify that the instance is about to shut down. */
     shutdownCallChain.call(client);
@@ -1523,7 +1510,7 @@ void GattClient::on_server_event(connection_handle_t connection, const AttServer
 
     switch (message.opcode) {
         case AttributeOpcode::HANDLE_VALUE_NOTIFICATION: {
-            const AttHandleValueNotification &notification =
+            const auto &notification =
                 static_cast<const AttHandleValueNotification &>(message);
             callbacks_params.handle = notification.attribute_handle;
             callbacks_params.type = BLE_HVX_NOTIFICATION;
@@ -1532,7 +1519,7 @@ void GattClient::on_server_event(connection_handle_t connection, const AttServer
         } break;
 
         case AttributeOpcode::HANDLE_VALUE_INDICATION: {
-            const AttHandleValueIndication &indication =
+            const auto &indication =
                 static_cast<const AttHandleValueIndication &>(message);
             callbacks_params.handle = indication.attribute_handle;
             callbacks_params.type = BLE_HVX_INDICATION;
diff --git a/connectivity/FEATURE_BLE/source/generic/GattClientImpl.h b/connectivity/FEATURE_BLE/source/generic/GattClientImpl.h
index ec99419df4..c4f059d284 100644
--- a/connectivity/FEATURE_BLE/source/generic/GattClientImpl.h
+++ b/connectivity/FEATURE_BLE/source/generic/GattClientImpl.h
@@ -61,8 +61,8 @@ public:
 
     ble_error_t launchServiceDiscovery(
         ble::connection_handle_t connectionHandle,
-        ServiceDiscovery::ServiceCallback_t sc = NULL,
-        ServiceDiscovery::CharacteristicCallback_t cc = NULL,
+        ServiceDiscovery::ServiceCallback_t sc = nullptr,
+        ServiceDiscovery::CharacteristicCallback_t cc = nullptr,
         const UUID &matchingServiceUUID = UUID::ShortUUIDBytes_t(BLE_UUID_UNKNOWN),
         const UUID &matchingCharacteristicUUIDIn = UUID::ShortUUIDBytes_t(BLE_UUID_UNKNOWN)
     );
@@ -140,9 +140,6 @@ public:
 
     void onShutdown(const GattClientShutdownCallback_t &callback);
 
-    template<typename T>
-    void onShutdown(T *objPtr, void (T::*memberPtr)(const GattClient *));
-
     GattClientShutdownCallbackChain_t &onShutdown();
 
     HVXCallbackChain_t &onHVX();
@@ -178,7 +175,7 @@ private:
     void on_att_mtu_change(
         ble::connection_handle_t connection_handle,
         uint16_t att_mtu_size
-    );
+    ) override;
 
     /**
      * @see PalGattClient::EventHandler::on_write_command_sent
@@ -187,7 +184,7 @@ private:
         ble::connection_handle_t connection_handle,
         ble::attribute_handle_t attribute_handle,
         uint8_t status
-    );
+    ) override;
 
 private:
     struct ProcedureControlBlock;
@@ -260,9 +257,7 @@ private:
      */
     GattClient(PalGattClient &pal_client);
 
-    ~GattClient()
-    {
-    }
+    ~GattClient() = default;
 
     void setInterface(ble::GattClient *client_interface)
     {
diff --git a/connectivity/FEATURE_BLE/source/generic/GattServerImpl.cpp b/connectivity/FEATURE_BLE/source/generic/GattServerImpl.cpp
index f33ad1483f..dcbe258fca 100644
--- a/connectivity/FEATURE_BLE/source/generic/GattServerImpl.cpp
+++ b/connectivity/FEATURE_BLE/source/generic/GattServerImpl.cpp
@@ -18,7 +18,7 @@
 
 #include "ble/common/BLERoles.h"
 #include <algorithm>
-#include "GattServerImpl.h"
+#include "source/generic/GattServerImpl.h"
 #include "source/BLEInstanceBase.h"
 #include "wsf_types.h"
 #include "att_api.h"
@@ -1285,7 +1285,7 @@ void GattServer::add_generic_attribute_service()
 
 void *GattServer::alloc_block(size_t block_size)
 {
-    alloc_block_t *block = (alloc_block_t *) malloc(sizeof(alloc_block_t) + block_size);
+    auto *block = (alloc_block_t *) malloc(sizeof(alloc_block_t) + block_size);
     if (block == nullptr) {
         return nullptr;
     }
diff --git a/connectivity/FEATURE_BLE/source/generic/GattServerImpl.h b/connectivity/FEATURE_BLE/source/generic/GattServerImpl.h
index 29409666a9..67e31c7726 100644
--- a/connectivity/FEATURE_BLE/source/generic/GattServerImpl.h
+++ b/connectivity/FEATURE_BLE/source/generic/GattServerImpl.h
@@ -19,25 +19,29 @@
 #ifndef MBED_CORDIO_GATT_SERVER_H__
 #define MBED_CORDIO_GATT_SERVER_H__
 
-#include "ble/common/CallChainOfFunctionPointersWithContext.h"
+
+#include <cstddef>
+
+#include "wsf_types.h"
+#include "att_api.h"
+
+
+#include "ble/GattServer.h"
+#include "ble/Gap.h"
+#include "ble/SecurityManager.h"
 
 #include "ble/gatt/GattService.h"
 #include "ble/gatt/GattAttribute.h"
-#include "GattServerEvents.h"
+#include "ble/gatt/GattCallbackParamTypes.h"
 #include "ble/gatt/GattCallbackParamTypes.h"
 
-#include <stddef.h>
-#include <ble/GattServer.h>
+#include "ble/common/CallChainOfFunctionPointersWithContext.h"
 #include "ble/common/blecommon.h"
-#include "ble/Gap.h"
-#include "wsf_types.h"
-#include "att_api.h"
-#include "SecurityManager.h"
 
-#include "ble/gatt/GattCallbackParamTypes.h"
-#include "source/pal/PalSigningMonitor.h"
+
 #include "source/BLEInstanceBase.h"
-
+#include "source/generic/GattServerEvents.h"
+#include "source/pal/PalSigningMonitor.h"
 
 namespace ble {
 
diff --git a/connectivity/FEATURE_BLE/source/generic/MemorySecurityDb.h b/connectivity/FEATURE_BLE/source/generic/MemorySecurityDb.h
index 7c3431a3f7..25cd90883a 100644
--- a/connectivity/FEATURE_BLE/source/generic/MemorySecurityDb.h
+++ b/connectivity/FEATURE_BLE/source/generic/MemorySecurityDb.h
@@ -27,7 +27,7 @@ namespace ble {
 class MemorySecurityDb : public SecurityDb {
 private:
     struct entry_t {
-        entry_t() { };
+        entry_t() = default;
         SecurityDistributionFlags_t flags;
         SecurityEntryKeys_t local_keys;
         SecurityEntryKeys_t peer_keys;
@@ -42,21 +42,21 @@ private:
 
 public:
     MemorySecurityDb() : SecurityDb() { }
-    virtual ~MemorySecurityDb() { }
+    ~MemorySecurityDb() override = default;
 
-    virtual SecurityDistributionFlags_t* get_distribution_flags(
+    SecurityDistributionFlags_t* get_distribution_flags(
         entry_handle_t db_handle
-    ) {
+    ) override {
         return reinterpret_cast<SecurityDistributionFlags_t*>(db_handle);
     }
 
     /* local keys */
 
     /* set */
-    virtual void set_entry_local_ltk(
+    void set_entry_local_ltk(
         entry_handle_t db_handle,
         const ltk_t &ltk
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->flags.ltk_sent = true;
@@ -64,11 +64,11 @@ public:
         }
     }
 
-    virtual void set_entry_local_ediv_rand(
+    void set_entry_local_ediv_rand(
         entry_handle_t db_handle,
         const ediv_t &ediv,
         const rand_t &rand
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->local_keys.ediv = ediv;
@@ -80,10 +80,10 @@ public:
 
     /* set */
 
-    virtual void set_entry_peer_ltk(
+    void set_entry_peer_ltk(
         entry_handle_t db_handle,
         const ltk_t &ltk
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->peer_keys.ltk = ltk;
@@ -91,11 +91,11 @@ public:
         }
     }
 
-    virtual void set_entry_peer_ediv_rand(
+    void set_entry_peer_ediv_rand(
         entry_handle_t db_handle,
         const ediv_t &ediv,
         const rand_t &rand
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->peer_keys.ediv = ediv;
@@ -103,10 +103,10 @@ public:
         }
     }
 
-    virtual void set_entry_peer_irk(
+    void set_entry_peer_irk(
         entry_handle_t db_handle,
         const irk_t &irk
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->peer_identity.irk = irk;
@@ -114,11 +114,11 @@ public:
         }
     }
 
-    virtual void set_entry_peer_bdaddr(
+    void set_entry_peer_bdaddr(
         entry_handle_t db_handle,
         bool address_is_public,
         const address_t &peer_address
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->peer_identity.identity_address = peer_address;
@@ -126,10 +126,10 @@ public:
         }
     }
 
-    virtual void set_entry_peer_csrk(
+    void set_entry_peer_csrk(
         entry_handle_t db_handle,
         const csrk_t &csrk
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->flags.csrk_stored = true;
@@ -137,10 +137,10 @@ public:
         }
     }
 
-    virtual void set_entry_peer_sign_counter(
+    void set_entry_peer_sign_counter(
         entry_handle_t db_handle,
         sign_count_t sign_counter
-    ) {
+    ) override {
         entry_t *entry = as_entry(db_handle);
         if (entry) {
             entry->peer_signing.counter = sign_counter;
@@ -148,40 +148,40 @@ public:
     }
 
 private:
-    virtual uint8_t get_entry_count() {
+    uint8_t get_entry_count() override {
         return BLE_SECURITY_DATABASE_MAX_ENTRIES;
     }
 
-    virtual SecurityDistributionFlags_t* get_entry_handle_by_index(uint8_t index) {
+    SecurityDistributionFlags_t* get_entry_handle_by_index(uint8_t index) override {
         if (index < BLE_SECURITY_DATABASE_MAX_ENTRIES) {
             return &_entries[index].flags;
         } else {
-            return NULL;
+            return nullptr;
         }
     }
 
-    virtual void reset_entry(entry_handle_t db_entry) {
-        entry_t *entry = reinterpret_cast<entry_t*>(db_entry);
+    void reset_entry(entry_handle_t db_entry) override{
+        auto *entry = reinterpret_cast<entry_t*>(db_entry);
         *entry = entry_t();
     }
 
-    virtual SecurityEntryIdentity_t* read_in_entry_peer_identity(entry_handle_t db_entry) {
-        entry_t *entry = reinterpret_cast<entry_t*>(db_entry);
+    SecurityEntryIdentity_t* read_in_entry_peer_identity(entry_handle_t db_entry) override {
+        auto *entry = reinterpret_cast<entry_t*>(db_entry);
         return &entry->peer_identity;
     };
 
-    virtual SecurityEntryKeys_t* read_in_entry_peer_keys(entry_handle_t db_entry) {
-        entry_t *entry = reinterpret_cast<entry_t*>(db_entry);
+    SecurityEntryKeys_t* read_in_entry_peer_keys(entry_handle_t db_entry) override {
+        auto *entry = reinterpret_cast<entry_t*>(db_entry);
         return &entry->peer_keys;
     };
 
-    virtual SecurityEntryKeys_t* read_in_entry_local_keys(entry_handle_t db_entry) {
-        entry_t *entry = reinterpret_cast<entry_t*>(db_entry);
+    SecurityEntryKeys_t* read_in_entry_local_keys(entry_handle_t db_entry) override {
+        auto *entry = reinterpret_cast<entry_t*>(db_entry);
         return &entry->local_keys;
     };
 
-    virtual SecurityEntrySigning_t* read_in_entry_peer_signing(entry_handle_t db_entry) {
-        entry_t *entry = reinterpret_cast<entry_t*>(db_entry);
+    SecurityEntrySigning_t* read_in_entry_peer_signing(entry_handle_t db_entry) override {
+        auto *entry = reinterpret_cast<entry_t*>(db_entry);
         return &entry->peer_signing;
     };
 
diff --git a/connectivity/FEATURE_BLE/source/generic/SecurityDb.h b/connectivity/FEATURE_BLE/source/generic/SecurityDb.h
index a66bc56eac..e6a24e709a 100644
--- a/connectivity/FEATURE_BLE/source/generic/SecurityDb.h
+++ b/connectivity/FEATURE_BLE/source/generic/SecurityDb.h
@@ -19,7 +19,7 @@
 #ifndef GENERIC_SECURITY_MANAGER_DB_H__
 #define GENERIC_SECURITY_MANAGER_DB_H__
 
-#include <stdlib.h>
+#include <cstdlib>
 #include "platform/Callback.h"
 
 #include "ble/common/BLETypes.h"
@@ -127,7 +127,7 @@ public:
         WhitelistDbCb_t;
 
     SecurityDb() : _local_sign_counter(0) { };
-    virtual ~SecurityDb() { };
+    virtual ~SecurityDb() = default;
 
     /**
      * Return immediately security flags associated to a db entry.
@@ -486,7 +486,7 @@ public:
             return flags;
         }
 
-        return NULL;
+        return nullptr;
     }
 
     /**
@@ -535,7 +535,7 @@ public:
             }
         }
 
-        return NULL;
+        return nullptr;
     }
 
     /**
@@ -704,7 +704,7 @@ private:
      */
     virtual SecurityDistributionFlags_t* get_free_entry_flags() {
         /* get a free one if available */
-        SecurityDistributionFlags_t* match = NULL;
+        SecurityDistributionFlags_t* match = nullptr;
         for (size_t i = 0; i < get_entry_count(); i++) {
             entry_handle_t db_handle = get_entry_handle_by_index(i);
             SecurityDistributionFlags_t* flags = get_distribution_flags(db_handle);
diff --git a/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.cpp b/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.cpp
index 9fdbdb6e1e..e0fa23f83a 100644
--- a/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.cpp
+++ b/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.cpp
@@ -18,11 +18,12 @@
 
 #include "ble/common/BLERoles.h"
 
-#include "SecurityManagerImpl.h"
 #include "source/pal/PalSecurityManager.h"
-#include "MemorySecurityDb.h"
-#include "FileSecurityDb.h"
-#include "KVStoreSecurityDb.h"
+
+#include "source/generic/SecurityManagerImpl.h"
+#include "source/generic/MemorySecurityDb.h"
+#include "source/generic/FileSecurityDb.h"
+#include "source/generic/KVStoreSecurityDb.h"
 
 using ble::advertising_peer_address_type_t;
 using ble::AuthenticationMask;
@@ -33,27 +34,27 @@ namespace ble {
 namespace impl {
 
 namespace {
-static constexpr auto SECURITY_MODE_ENCRYPTION_OPEN_LINK =
+constexpr auto SECURITY_MODE_ENCRYPTION_OPEN_LINK =
     ble::SecurityManager::SECURITY_MODE_ENCRYPTION_OPEN_LINK;
 
-static constexpr auto SECURITY_MODE_ENCRYPTION_NO_MITM =
+constexpr auto SECURITY_MODE_ENCRYPTION_NO_MITM =
     ble::SecurityManager::SECURITY_MODE_ENCRYPTION_NO_MITM;
 
-static constexpr auto SECURITY_MODE_ENCRYPTION_WITH_MITM =
+constexpr auto SECURITY_MODE_ENCRYPTION_WITH_MITM =
     ble::SecurityManager::SECURITY_MODE_ENCRYPTION_WITH_MITM;
 
-static constexpr auto SECURITY_MODE_SIGNED_NO_MITM =
+constexpr auto SECURITY_MODE_SIGNED_NO_MITM =
     ble::SecurityManager::SECURITY_MODE_SIGNED_NO_MITM;
 
-static constexpr auto SECURITY_MODE_SIGNED_WITH_MITM =
+constexpr auto SECURITY_MODE_SIGNED_WITH_MITM =
     ble::SecurityManager::SECURITY_MODE_SIGNED_WITH_MITM;
 
 using SecurityCompletionStatus_t = ble::SecurityManager::SecurityCompletionStatus_t;
 
-static constexpr auto SEC_STATUS_TIMEOUT =
+constexpr auto SEC_STATUS_TIMEOUT =
     ble::SecurityManager::SEC_STATUS_TIMEOUT;
 
-static constexpr auto SEC_STATUS_SUCCESS =
+constexpr auto SEC_STATUS_SUCCESS =
     ble::SecurityManager::SEC_STATUS_SUCCESS;
 
 }
@@ -153,8 +154,8 @@ ble_error_t SecurityManager::setDatabaseFilepath(
     if (!_db) return BLE_ERROR_INITIALIZATION_INCOMPLETE;
 
     /* operation only allowed with no connections active */
-    for (size_t i = 0; i < MAX_CONTROL_BLOCKS; i++) {
-        if (_control_blocks[i].connected) {
+    for (auto & _control_block : _control_blocks) {
+        if (_control_block.connected) {
             return BLE_ERROR_OPERATION_NOT_PERMITTED;
         }
     }
@@ -982,7 +983,7 @@ ble_error_t SecurityManager::init_resolving_list()
 
     /* match the resolving list to the currently stored set of IRKs */
     uint8_t resolving_list_capacity = _pal.read_resolving_list_capacity();
-    SecurityEntryIdentity_t* identity_list_p =
+    auto* identity_list_p =
         new (std::nothrow) SecurityEntryIdentity_t[resolving_list_capacity];
 
     if (identity_list_p) {
@@ -1921,7 +1922,7 @@ void SecurityManager::on_ltk_request(
 
 SecurityManager::ControlBlock_t::ControlBlock_t() :
     connection(0),
-    db_entry(0),
+    db_entry(nullptr),
     local_address(),
     connected(false),
     authenticated(false),
@@ -1959,9 +1960,9 @@ typename SecurityManager::ControlBlock_t*
 SecurityManager::acquire_control_block(connection_handle_t connection)
 {
     /* grab the first disconnected slot*/
-    for (size_t i = 0; i < MAX_CONTROL_BLOCKS; i++) {
-        if (!_control_blocks[i].connected) {
-            ControlBlock_t* cb = &_control_blocks[i];
+    for (auto & control_block : _control_blocks) {
+        if (!control_block.connected) {
+            ControlBlock_t* cb = &control_block;
             cb->connected = true;
             cb->connection = connection;
             return cb;
@@ -1977,11 +1978,11 @@ SecurityManager::get_control_block(
     connection_handle_t connection
 )
 {
-    for (size_t i = 0; i < MAX_CONTROL_BLOCKS; i++) {
-        if (!_control_blocks[i].connected) {
+    for (auto & cb : _control_blocks) {
+        if (!cb.connected) {
             continue;
-        } else if (connection == _control_blocks[i].connection) {
-            return &_control_blocks[i];
+        } else if (connection == cb.connection) {
+            return &cb;
         }
     }
     return nullptr;
@@ -1994,8 +1995,8 @@ SecurityManager::get_control_block(
 )
 {
     MBED_ASSERT(_db);
-    for (size_t i = 0; i < MAX_CONTROL_BLOCKS; i++) {
-        ControlBlock_t *cb = &_control_blocks[i];
+    for (auto & control_block : _control_blocks) {
+        ControlBlock_t *cb = &control_block;
         if (cb->connected) {
             SecurityDistributionFlags_t* flags = _db->get_distribution_flags(cb->db_entry);
             if (flags && (flags->peer_address == peer_address)) {
@@ -2012,11 +2013,11 @@ SecurityManager::get_control_block(
     SecurityDb::entry_handle_t db_entry
 )
 {
-    for (size_t i = 0; i < MAX_CONTROL_BLOCKS; i++) {
-        if (!_control_blocks[i].connected) {
+    for (auto & cb : _control_blocks) {
+        if (!cb.connected) {
             continue;
-        } else if (db_entry == _control_blocks[i].db_entry) {
-            return &_control_blocks[i];
+        } else if (db_entry == cb.db_entry) {
+            return &cb;
         }
     }
     return nullptr;
diff --git a/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.h b/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.h
index 19c6d7b933..c04121841f 100644
--- a/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.h
+++ b/connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.h
@@ -19,21 +19,25 @@
 #ifndef IMPL_SECURITY_MANAGER_H_
 #define IMPL_SECURITY_MANAGER_H_
 
-#include <stdint.h>
-#include "ble/common/CallChainOfFunctionPointersWithContext.h"
+#include <cstdint>
+
 #include "platform/Callback.h"
 
+#include "ble/Gap.h"
+#include "ble/SecurityManager.h"
+
+#include "ble/common/CallChainOfFunctionPointersWithContext.h"
 #include "ble/common/BLETypes.h"
 #include "ble/common/blecommon.h"
-#include "ble/Gap.h"
+#include "ble/common/BLETypes.h"
 
 #include "source/pal/GapTypes.h"
-#include "ble/common/BLETypes.h"
-#include "SecurityDb.h"
 #include "source/pal/PalConnectionMonitor.h"
 #include "source/pal/PalSigningMonitor.h"
 #include "source/pal/PalSecurityManager.h"
-#include "ble/SecurityManager.h"
+
+#include "source/generic/SecurityDb.h"
+
 
 namespace ble {
 class PalGenericAccessService;
@@ -70,12 +74,12 @@ public:
         bool enableBonding = true,
         bool requireMITM = true,
         SecurityIOCapabilities_t iocaps = IO_CAPS_NONE,
-        const Passkey_t passkey = NULL,
+        const Passkey_t passkey = nullptr,
         bool signing = true,
-        const char *dbFilepath = NULL
+        const char *dbFilepath = nullptr
     );
 
-    ble_error_t setDatabaseFilepath(const char *dbFilepath = NULL);
+    ble_error_t setDatabaseFilepath(const char *dbFilepath = nullptr);
 
     ble_error_t reset(ble::SecurityManager* sm);
 
@@ -85,7 +89,7 @@ public:
     // List management
     //
 
-    ble_error_t purgeAllBondingState(void);
+    ble_error_t purgeAllBondingState();
 
     ble_error_t generateWhitelistFromBondTable(::ble::whitelist_t *whitelist) const;
 
@@ -246,26 +250,26 @@ private:
         AuthenticationMask authentication,
         KeyDistribution initiator_dist,
         KeyDistribution responder_dist
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_pairing_error
      */
     void on_pairing_error(
         connection_handle_t connection,
         pairing_failure_t error
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_pairing_timed_out
      */
     void on_pairing_timed_out(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_pairing_completed
      */
     void on_pairing_completed(
         connection_handle_t connection
-    );
+    ) override;
 
     ////////////////////////////////////////////////////////////////////////////
     // Security
@@ -275,31 +279,31 @@ private:
      */
     void on_valid_mic_timeout(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_signed_write_received
      */
     void on_signed_write_received(
         connection_handle_t connection,
         uint32_t sign_coutner
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_signed_write_verification_failure
      */
     void on_signed_write_verification_failure(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_signed_write
      */
-    void on_signed_write();
+    void on_signed_write() override;
 
     /** @copydoc PalSecurityManager::on_slave_security_request
      */
     void on_slave_security_request(
         connection_handle_t connection,
         AuthenticationMask authentication
-    );
+    ) override;
 
     ////////////////////////////////////////////////////////////////////////////
     // Encryption
@@ -310,13 +314,13 @@ private:
     void on_link_encryption_result(
         connection_handle_t connection,
         link_encryption_t result
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_link_encryption_request_timed_out
      */
     void on_link_encryption_request_timed_out(
         connection_handle_t connection
-    );
+    ) override;
 
     ////////////////////////////////////////////////////////////////////////////
     // MITM
@@ -327,45 +331,45 @@ private:
     void on_passkey_display(
         connection_handle_t connection,
         passkey_num_t passkey
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keypress_notification
      */
     void on_keypress_notification(
         connection_handle_t connection,
         ble::Keypress_t keypress
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_passkey_request
      */
     void on_passkey_request(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_confirmation_request
      */
     void on_confirmation_request(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_secure_connections_oob_request
      */
     void on_secure_connections_oob_request(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_legacy_pairing_oob_request
      */
     void on_legacy_pairing_oob_request(
         connection_handle_t connection
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_secure_connections_oob_generated
      */
     void on_secure_connections_oob_generated(
         const oob_lesc_value_t &random,
         const oob_confirm_t &confirm
-    );
+    ) override;
 
     ////////////////////////////////////////////////////////////////////////////
     // Keys
@@ -376,14 +380,14 @@ private:
     void on_secure_connections_ltk_generated(
         connection_handle_t connection,
         const ltk_t &ltk
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_ltk
      */
     void on_keys_distributed_ltk(
         connection_handle_t connection,
         const ltk_t &ltk
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_ediv_rand
      */
@@ -391,14 +395,14 @@ private:
         connection_handle_t connection,
         const ediv_t &ediv,
         const rand_t &rand
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_local_ltk
      */
     void on_keys_distributed_local_ltk(
         connection_handle_t connection,
         const ltk_t &ltk
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_local_ediv_rand
      */
@@ -406,14 +410,14 @@ private:
         connection_handle_t connection,
         const ediv_t &ediv,
         const rand_t &rand
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_irk
      */
     void on_keys_distributed_irk(
         connection_handle_t connection,
         const irk_t &irk
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_bdaddr
      */
@@ -421,14 +425,14 @@ private:
         connection_handle_t connection,
         advertising_peer_address_type_t peer_address_type,
         const address_t &peer_identity_address
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_keys_distributed_csrk
      */
     void on_keys_distributed_csrk(
         connection_handle_t connection,
         const csrk_t &csrk
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_ltk_requeston_ltk_request
      */
@@ -436,13 +440,13 @@ private:
         connection_handle_t connection,
         const ediv_t &ediv,
         const rand_t &rand
-    );
+    ) override;
 
     /** @copydoc PalSecurityManager::on_ltk_requeston_ltk_request
      */
     void on_ltk_request(
         connection_handle_t connection
-    );
+    ) override;
 
     /* end implements PalSecurityManager::EventHandler */
 
@@ -460,7 +464,7 @@ private:
         _pal(palImpl),
         _connection_monitor(connMonitorImpl),
         _signing_monitor(signingMonitorImpl),
-        _db(NULL),
+        _db(nullptr),
         _default_authentication(0),
         _default_key_distribution(KeyDistribution::KEY_DISTRIBUTION_ALL),
         _pairing_authorisation_required(false),
@@ -487,7 +491,7 @@ private:
 
 private:
 
-    ble_error_t init_database(const char *db_path = NULL);
+    ble_error_t init_database(const char *db_path = nullptr);
 
     ble_error_t init_resolving_list();
 
@@ -544,12 +548,12 @@ private:
         address_t peer_address,
         own_address_type_t local_address_type,
         address_t local_address
-    );
+    ) override;
 
     void on_disconnected(
         connection_handle_t connection,
         disconnection_reason_t reason
-    );
+    ) override;
 
     void on_security_entry_retrieved(
         SecurityDb::entry_handle_t entry,
diff --git a/connectivity/FEATURE_BLE/source/pal/PalSecurityManager.h b/connectivity/FEATURE_BLE/source/pal/PalSecurityManager.h
index 7535493c8a..96ddc9459c 100644
--- a/connectivity/FEATURE_BLE/source/pal/PalSecurityManager.h
+++ b/connectivity/FEATURE_BLE/source/pal/PalSecurityManager.h
@@ -22,6 +22,7 @@
 #include "platform/Callback.h"
 #include "platform/NonCopyable.h"
 
+#include "ble/common/blecommon.h"
 #include "ble/common/BLETypes.h"
 #include "GapTypes.h"