====== FR-COMP-002 — Compliance Scanning Tool Integration ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL integrate with Compliance Scanning Tools.

===== Derived From =====

This requirement derives from:

  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-002

The Original Requirement states:

> //The system shall integrate with compliance scanning tools.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-002:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Capitalizes **Compliance Scanning Tools** as the named integration subject

No other substantive normalization is required.

===== Rationale =====

Compliance Scanning Tools evaluate systems, configurations, images, workloads, or other subjects against defined compliance criteria.

Integration allows Crucible to use externally implemented scanning capabilities without incorporating each scanning engine directly into the core Crucible implementation.

An integration can involve:

  * Supplying a scan subject
  * Supplying a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]
  * Initiating a scan
  * Supplying scan parameters
  * Receiving scan status
  * Receiving Compliance Findings
  * Receiving scan output
  * Receiving generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]

This requirement establishes integration with Compliance Scanning Tools without prescribing:

  * A particular Compliance Scanning Tool
  * A particular operating system
  * A particular scanning standard
  * An integration protocol
  * A command-line interface
  * An application programming interface
  * A plugin mechanism
  * A data format
  * Scan scheduling
  * Compliance-report generation
  * Preservation of Compliance Findings

Separate requirements, architecture specifications, workflows, or interface definitions govern those subjects and behaviors.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Compliance Scanning Tools
  * Compliance scanning integrations
  * Compliance scan operations

===== Verification =====

Verification confirms that:

  - A Compliance Scanning Tool is selected for testing
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] exchanges the information required to use the selected Compliance Scanning Tool
  - Crucible initiates or otherwise causes the selected Compliance Scanning Tool to perform a compliance scan
  - Crucible receives an observable result from the selected Compliance Scanning Tool
  - The observed interaction demonstrates integration with the selected Compliance Scanning Tool

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-002 as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether Compliance Scanning Tool requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether separate requirements define the information exchanged with a Compliance Scanning Tool.</todo>

<todo>Determine whether separate requirements govern preservation and processing of Compliance Findings returned by a Compliance Scanning Tool.</todo>

----
===== Notes for Editors =====

This requirement page retains the stable requirement identifier ''FR-COMP-002''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement preserves the approved source intent by requiring Crucible to integrate with Compliance Scanning Tools.

Do not replace **integrate with** with a narrower behavior such as **invoke**, **execute**, **load**, or **receive findings from** unless the controlling requirement identifies that specific interaction.

Do not add a particular Compliance Scanning Tool, operating system, scanning standard, protocol, interface, plugin mechanism, data format, scheduling, reporting, or finding-retention obligation unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-002#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>