====== FR-COMP-008a — Compliance Scanning Abstraction ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:start|Go to FR-COMP-008 — Operating-System-Independent Compliance Scanning]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL provide a Compliance Scanning Abstraction.

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:start|FR-COMP-008 — Operating-System-Independent Compliance Scanning]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-008

The Original Requirement states:

> //The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-008a:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Retains the direct behavior **provide**
  * Extracts provision of the Compliance Scanning Abstraction as an independently verifiable requirement
  * Assigns operating-system coverage to FR-COMP-008b
  * Excludes the OpenSCAP and RHEL 9 implementation example from the normative Statement

===== Rationale =====

A Compliance Scanning Abstraction separates Crucible compliance scanning operations from a particular scanning tool or operating-system-specific implementation.

The abstraction allows Crucible to use different compliance scanning implementations through a common architectural boundary.

This requirement establishes provision of the abstraction without prescribing:

  * A particular Compliance Scanning Tool
  * A particular operating system
  * A particular provider
  * A plugin mechanism
  * A provider discovery mechanism
  * An application programming interface
  * A command-line interface
  * A data exchange format
  * A common Compliance Finding format
  * Dynamic provider loading
  * Automatic operating-system detection

Separate requirements, architecture specifications, and interface definitions govern those subjects and behaviors.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Compliance scanning operations
  * Compliance scanning implementations
  * Compliance Scanning Tools

===== Verification =====

Verification confirms that:

  - A compliance scanning operation is selected for testing
  - Two compliance scanning implementations are configured behind the Compliance Scanning Abstraction
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] initiates the selected compliance scanning operation through the Compliance Scanning Abstraction
  - The selected compliance scanning operation can use either configured implementation without changing the Crucible operation that invokes the abstraction
  - Each configured implementation returns an observable scanning result through the abstraction

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-008a as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether Compliance Scanning Abstraction requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether the architecture defines the operations and information exposed by the Compliance Scanning Abstraction.</todo>

----
===== Notes for Editors =====

This requirement page retains the derived requirement identifier ''FR-COMP-008a''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement addresses only provision of the Compliance Scanning Abstraction.

FR-COMP-008b governs compliance scanning across two or more operating systems.

The OpenSCAP and RHEL 9 reference in the Original Requirement describes one implementation of the abstraction and does not create a requirement to use either technology.

Do not add provider loading, provider discovery, plugin registration, operating-system detection, interface protocol, data-format, or result-normalization obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008a#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>