====== FR-COMP-008b — Multiple Operating-System Support ====== [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:start|Go to FR-COMP-008 — Operating-System-Independent Compliance Scanning]] ===== Statement ===== [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL evaluate two or more Operating Systems against defined compliance criteria. ===== Derived From ===== This requirement derives from: * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:start|FR-COMP-008 — Operating-System-Independent Compliance Scanning]] * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-008 The Original Requirement states: > //The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] FR-COMP-008b: * Extracts the requirement that compliance evaluation is not limited to a single Operating System * Replaces the negative phrase **shall not be limited to a single operating system** with the positive and verifiable behavior **SHALL evaluate two or more Operating Systems against defined compliance criteria** * Uses **two or more Operating Systems** as the minimum verifiable threshold for multiple Operating-System support * Clarifies the purpose of the evaluation by identifying defined compliance criteria * Assigns provision of the Compliance Scanning Abstraction to FR-COMP-008a * Excludes the OpenSCAP and RHEL 9 implementation example from the normative Statement ===== Rationale ===== Evaluating only one Operating System would couple Crucible compliance capabilities to a single operating-system environment. Evaluation of two or more Operating Systems against defined compliance criteria demonstrates that Crucible can perform compliance evaluation across multiple Operating Systems. The Statement uses **evaluate** rather than **scan** because **evaluate** identifies the intended compliance behavior without prescribing a particular scanning technology, tool, or implementation method. This requirement establishes the minimum Operating-System coverage without prescribing: * Particular Operating Systems * Particular compliance criteria * A particular [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] * A particular Compliance Scanning Tool * A particular scanning provider * Identical evaluation capabilities for every Operating System * A common Compliance Baseline for every Operating System * A common result format * Automatic Operating-System detection * Provider selection * Provider installation * Dynamic provider loading * Use of OpenSCAP * Use of [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel|Red Hat Enterprise Linux (RHEL)]] Separate requirements, architecture specifications, compliance profiles, and interface definitions govern those subjects and behaviors. ===== Applies To ===== This requirement applies to: * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] * Operating Systems * Compliance criteria * Compliance evaluation operations * Compliance evaluation implementations ===== Verification ===== Verification confirms that: - Two different Operating Systems are selected for testing - Compliance criteria are defined for each selected Operating System - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] evaluates the first selected Operating System against its defined compliance criteria - Crucible evaluates the second selected Operating System against its defined compliance criteria - Each evaluation produces an observable result ===== Referenced By ===== The following pages reference this requirement: {{backlinks>.#dido:02-crusible}} ===== Implementation Status ===== Implemented and Verified ===== Requirement Status ===== Review and approve FR-COMP-008b as a leaf requirement. ---- ===== Issues ===== Determine whether Operating System requires a controlled definition in the shared Terms and Definitions corpus. Determine whether compliance criterion requires a controlled definition in the shared Terms and Definitions corpus. Determine whether separate requirements identify the Operating Systems that Crucible must evaluate. Determine whether separate requirements define the minimum compliance criteria for each Operating System. ---- ===== Notes for Editors ===== This requirement page retains the derived requirement identifier ''FR-COMP-008b''. This page is a leaf requirement page and omits a trailing '':start'' from its namespace. The namespace for this requirement is: ''dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008b'' The word **Support** remains in the page title as the name of the capability. The normative Statement does not use **support** as its governing verb. The Statement uses **evaluate** rather than **scan** because **evaluate against defined compliance criteria** identifies the intended compliance behavior more clearly. The Statement addresses only evaluation of two or more Operating Systems. FR-COMP-008a governs provision of the Compliance Scanning Abstraction. The OpenSCAP and RHEL 9 reference in the Original Requirement describes one current implementation and does not create a requirement to use either technology. Do not add particular Operating Systems, compliance criteria, Compliance Baselines, scanning tools, scanning providers, provider-selection behavior, automatic detection, common result formats, or equivalent evaluation coverage unless the controlling requirement changes through an approved requirements process. To reference this requirement Statement from another wiki page, insert: {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008b#Statement&noheader&nofooter&noeditbtn}} ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.