====== MO-001d — Security Baseline Conformance ====== [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:start|Go to MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments]] ===== Statement ===== [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL create an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] that conforms to the selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]]. ===== Derived From ===== This requirement derives from: * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:start|MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments]] The Original Requirement states: > //Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] MO-001d preserves the portion of the Original Requirement that characterizes Infrastructure Environments as **secure** by requiring each created Infrastructure Environment to conform to the selected Security Baseline. The separate requirements derived from MO-001 address: * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001a|MO-001a — Infrastructure Environment Creation]] * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001b|MO-001b — Deployment Duration]] * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c|MO-001c — Reproducibility]] * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e|MO-001e — Compliance Baseline Conformance]] ===== Rationale ===== The word **secure** does not establish an objective security obligation unless a controlling Security Baseline identifies the required security controls and conformance criteria. The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] provides the controlled security requirements against which the created Infrastructure Environment is evaluated. Security Baseline conformance supports: * Consistent application of required security controls * Objective evaluation of the created Infrastructure Environment * Identification of unmet or incorrectly implemented controls * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] generation * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] * Independent review of security outcomes Separating Security Baseline conformance from Infrastructure Environment creation permits Crucible to create an Infrastructure Environment while independently passing or failing the security requirement. This requirement does not establish a deployment-duration threshold, reproducibility criterion, or [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. The other requirements derived from MO-001 address those outcomes. ===== Applies To ===== This requirement applies to: * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environments]] * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baselines]] * Security controls * Security-control implementation * Security-control evaluation * Security findings * [[dido:99_annexes:annex-b-terms-and-definitions:c:controlled_input|Controlled Inputs]] * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baselines]] * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_configuration|Infrastructure Configurations]] * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] * [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environments]] * [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environments]] * [[dido:99_annexes:annex-b-terms-and-definitions:a:air-gapped_environment|Air-Gapped Environments]] ===== Verification ===== Verification confirms that: - The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] is identified - The Security Baseline identifies the security controls and conformance criteria used for evaluation - The created [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] is evaluated against the selected Security Baseline - Each required security control is evaluated - The created Infrastructure Environment satisfies the conformance criteria defined by the selected Security Baseline - Any security finding is identified and associated with the affected security control - The verification record preserves [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] among the selected Security Baseline, the evaluated security controls, the created Infrastructure Environment, and the evaluation result ===== Referenced By ===== The following pages reference this requirement: {{backlinks>.#dido:02-crusible}} ===== Delivery Phase ===== Implemented and Verified ===== Implementation Status ===== Assess whether the current Crucible implementation creates Infrastructure Environments that conform to the selected Security Baseline. ===== Requirement Status ===== Review and accept MO-001d as a proposed derived requirement created from the evaluation and decomposition of MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft. ---- ===== Issues ===== The following unresolved issues affect this requirement: Identify the controlling source that selects the Security Baseline for each Infrastructure Environment. Identify the security controls and conformance criteria that determine Security Baseline conformance. Define how exceptions, deviations, waivers, and compensating controls affect Security Baseline conformance. Define whether an Infrastructure Environment with unresolved security findings can satisfy this requirement. ---- ===== Notes for Editors ===== This requirement page should retain the stable requirement identifier ''MO-001d''. This page is a leaf requirement page and omits a trailing '':start'' from its namespace. The parent MO-001 page is a non-leaf page and retains a trailing '':start'' in its namespace. Changes to the Statement should preserve: * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor * Creation of an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] as the required outcome * The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] as the controlling security source * Conformance to the selected Security Baseline as the required security outcome The unresolved Security Baseline selection and conformance criteria should remain recorded in the Issues section until a controlling source resolves them. Material changes should receive review and should update the verification criteria, source records, and Issues section. To reference this requirement Statement from another wiki page, insert: {{section>dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d#Statement&noheader&nofooter&noeditbtn}} Do not rename this page after an external citation unless a redirect or move plan is in place. ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.