====== FR-COMP-001 — Compliance Baseline Definitions ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL define [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]].

===== Derived From =====

This requirement derives from:

  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-001

The Original Requirement states:

> //The system shall support compliance baseline definitions.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-001:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Replaces the weak verb **support** with the observable behavior **define**
  * Uses the defined [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] concept

No other substantive normalization is required.

===== Rationale =====

A [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] identifies a controlled set of compliance criteria used to evaluate a subject.

Defining Compliance Baselines allows Crucible to establish the criteria against which separately governed compliance scanning, assessment, reporting, and evidence-generation activities operate.

A Compliance Baseline can identify:

  * Compliance criteria
  * Security controls
  * Configuration rules
  * Evaluation procedures
  * Expected values
  * Severity classifications
  * Applicability conditions
  * Required evidence
  * References to external compliance frameworks

This requirement establishes definition of Compliance Baselines without prescribing:

  * Import of externally defined Compliance Baselines
  * Application of a Compliance Baseline
  * Compliance scanning
  * Compliance assessment
  * Compliance reporting
  * Generation of compliance Evidence
  * A specific compliance framework
  * A specific operating system
  * A specific scanning tool
  * Approval or version-management behavior

Separate requirements, architecture specifications, workflows, or policies define those subjects and behaviors.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]]
  * Compliance Baseline definition operations

===== Verification =====

Verification confirms that:

  - Compliance criteria are selected for inclusion in a Compliance Baseline
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] defines a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] containing the selected compliance criteria
  - The resulting Compliance Baseline can be identified
  - The compliance criteria defined by the resulting Compliance Baseline can be determined

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-001 as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether separate requirements govern Compliance Baseline identifiers, revisions, approval, and lifecycle state.</todo>

<todo>Determine whether separate requirements govern importing and maintaining externally defined Compliance Baselines.</todo>

<todo>Determine whether Compliance Baseline Definition requires a separate controlled term or whether Compliance Baseline is sufficient.</todo>

----
===== Notes for Editors =====

This requirement page retains the stable requirement identifier ''FR-COMP-001''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement preserves the approved source intent by requiring Crucible to define Compliance Baselines.

Do not change **define** to **maintain**, **import**, **apply**, **scan against**, or **assess against** without a corresponding change to the controlling requirement. Each verb establishes a different behavior.

Do not add DISA STIG, FedRAMP, custom-framework, scanning-tool, reporting, Evidence-generation, approval, revision-management, or Compliance Baseline application obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-001#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>