====== FR-COMP-005 — DISA STIG Compliance Baselines ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL provide [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]] [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]].

===== Derived From =====

This requirement derives from:

  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-005

The Original Requirement states:

> //The system shall support [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|DISA]] [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|STIG]] compliance baselines.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-005:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Replaces the weak verb **support** with **provide**
  * Links **DISA**, **STIG**, and **Compliance Baselines** to their controlling definitions
  * Preserves DISA STIG as the source-identified compliance framework

No other substantive normalization is required.

===== Rationale =====

The [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]] publishes [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guides (STIGs)]] that provide security configuration guidance and associated evaluation criteria for specified technologies.

A DISA STIG [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] enables Crucible compliance activities to use criteria derived from an identified STIG.

Such a Compliance Baseline can include:

  * Security configuration requirements
  * Evaluation criteria
  * Expected values
  * Severity classifications
  * Applicability conditions
  * Check procedures
  * Remediation guidance
  * References to the source STIG
  * References to related security controls

This requirement establishes provision of DISA STIG Compliance Baselines without prescribing:

  * Which STIGs Crucible provides
  * A particular STIG revision
  * The process used to create or import a Compliance Baseline
  * Application of a Compliance Baseline
  * Compliance scanning
  * Compliance assessment
  * Remediation
  * Compliance reporting
  * Evidence generation
  * Automatic updates
  * Approval or lifecycle management

Separate requirements, architecture specifications, workflows, or policies define those subjects and behaviors.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guides (STIGs)]]
  * DISA STIG [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]]

===== Verification =====

Verification confirms that:

  - A [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] is selected for testing
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] provides a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] associated with the selected STIG
  - The provided Compliance Baseline identifies the DISA STIG from which it derives
  - The compliance criteria represented by the provided Compliance Baseline can be determined
  - The resulting Compliance Baseline can be identified

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-005 as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether separate requirements identify the DISA STIG products and revisions that Crucible must provide.</todo>

<todo>Determine whether separate requirements govern importing, updating, approving, and applying DISA STIG Compliance Baselines.</todo>

----
===== Notes for Editors =====

This requirement page retains the stable requirement identifier ''FR-COMP-005''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement preserves the approved source intent by requiring Crucible to provide DISA STIG Compliance Baselines.

Use the following controlling Terms and Definitions entries:

  * [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]

Do not change **provide** to **define**, **import**, **maintain**, **apply**, **scan against**, or **assess against** unless the controlling requirement identifies that specific behavior.

Do not add a particular STIG, STIG revision, operating system, scanning tool, update mechanism, remediation process, reporting obligation, or Evidence-generation obligation unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>