====== FR-COMP-007 — Custom Compliance Frameworks ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL define user-defined Compliance Frameworks.

===== Derived From =====

This requirement derives from:

  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-007

The Original Requirement states:

> //The system shall support custom compliance frameworks.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-007:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Replaces the weak verb **support** with the observable behavior **define**
  * Replaces the relative adjective **custom** with **user-defined**
  * Preserves Compliance Framework as the source-identified subject

No other substantive normalization is required.

===== Rationale =====

Organizations can operate under compliance obligations that extend beyond standardized frameworks such as [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]] [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guides (STIGs)]] and [[dido:99_annexes:annex-b-terms-and-definitions:f:fedramp|Federal Risk and Authorization Management Program (FedRAMP)]] baselines.

User-defined Compliance Frameworks allow an organization to represent compliance criteria derived from:

  * Organizational policies
  * Contractual obligations
  * Program-specific requirements
  * Mission-specific requirements
  * Customer requirements
  * Industry standards
  * Regulatory obligations
  * Local security policies
  * Combinations of existing compliance frameworks

A user-defined Compliance Framework can organize:

  * Compliance requirements
  * Security controls
  * Compliance criteria
  * Control mappings
  * Evaluation procedures
  * Expected values
  * Severity classifications
  * Required Evidence
  * References to source authorities
  * Associated [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]]

This requirement establishes definition of user-defined Compliance Frameworks without prescribing:

  * A particular Compliance Framework
  * A particular source authority
  * Import of an externally defined framework
  * Mapping between Compliance Frameworks
  * Application of a Compliance Framework
  * Compliance scanning
  * Compliance assessment
  * Compliance reporting
  * Evidence generation
  * Framework approval
  * Framework publication
  * Framework version management

Separate requirements, architecture specifications, workflows, or policies define those subjects and behaviors.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * User-defined Compliance Frameworks
  * Compliance Framework definition operations

===== Verification =====

Verification confirms that:

  - A set of user-specified compliance criteria is selected for testing
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] defines a Compliance Framework containing the selected compliance criteria
  - The resulting Compliance Framework can be identified
  - The compliance criteria contained in the resulting Compliance Framework can be determined
  - The resulting Compliance Framework is not restricted to a predefined DISA STIG or FedRAMP framework

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-007 as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether Compliance Framework requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether separate requirements govern importing, mapping, approving, publishing, and maintaining user-defined Compliance Frameworks.</todo>

<todo>Determine whether separate requirements govern deriving Compliance Baselines from user-defined Compliance Frameworks.</todo>

----
===== Notes for Editors =====

This requirement page retains the stable requirement identifier ''FR-COMP-007''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement preserves the approved source intent by requiring Crucible to define user-defined Compliance Frameworks.

The Statement uses **user-defined** rather than **custom** because **custom** does not identify who establishes the framework or how the framework differs from a predefined framework.

Do not change **define** to **provide**, **import**, **maintain**, **apply**, **scan against**, or **assess against** unless the controlling requirement identifies that specific behavior.

Do not add framework mapping, approval, publication, version management, scanning, reporting, or Evidence-generation obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-007#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>