====== FR-COMP-009b — Risk Management Framework Evidence ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start|Go to FR-COMP-009 — Security-Control Implementation Evidence]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL generate Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] for use in [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|Risk Management Framework (RMF)]] activities.

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start|FR-COMP-009 — Security-Control Implementation Evidence]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-009

The Original Requirement states:

> //The system shall generate security-control implementation evidence suitable for supporting [[dido:99_annexes:annex-b-terms-and-definitions:s:sctm|SCTM]], [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|RMF]], and [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|ATO]] processes.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-009b:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Extracts generation of Security-Control Implementation Evidence for the RMF context as an independently verifiable requirement
  * Replaces the weak phrase **suitable for supporting RMF processes** with the direct purpose **for use in Risk Management Framework activities**
  * Assigns SCTM Evidence to FR-COMP-009a
  * Assigns ATO Evidence to FR-COMP-009c

===== Rationale =====

The [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|Risk Management Framework (RMF)]] provides a structured process for managing security, privacy, and related risks throughout a system lifecycle.

Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] provides information that RMF participants can use when reviewing the implementation and assessment of Security Controls.

Such Evidence can support RMF activities involving:

  * Control implementation
  * Control assessment
  * Authorization preparation
  * Continuous monitoring
  * Risk review
  * Corrective-action planning

This requirement establishes generation of Security-Control Implementation Evidence for use in RMF activities without requiring Crucible to:

  * Select Security Controls
  * Approve Security Control implementations
  * Perform the responsibilities of a control assessor
  * Determine whether a Security Control operates effectively
  * Categorize a system
  * Make a risk-management decision
  * Accept residual risk
  * Perform the responsibilities of an [[dido:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]]
  * Issue an [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]]

Separate requirements, architecture specifications, evidence profiles, and RMF procedures govern those subjects and responsibilities.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Security-Control implementations
  * Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|Risk Management Framework (RMF)]] activities

===== Verification =====

Verification confirms that:

  - A Security Control implementation is selected for testing
  - An RMF activity requiring Security-Control Implementation Evidence is identified
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] generates Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] for the selected implementation
  - The generated Evidence identifies or references the Security Control implementation that the Evidence describes
  - The generated Evidence can be used as input to the identified RMF activity
  - The relationship between the generated Evidence and the identified RMF activity can be determined

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-009b as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether Security Control requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether Security-Control Implementation Evidence requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether separate requirements define the minimum identifiers, provenance, and references required for Evidence used in RMF activities.</todo>

<todo>Determine whether separate requirements identify the RMF activities for which Crucible must generate Evidence.</todo>

----
===== Notes for Editors =====

This requirement page retains the derived requirement identifier ''FR-COMP-009b''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The namespace for this requirement is:

''dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b''

The Statement addresses only generation of Security-Control Implementation Evidence for use in Risk Management Framework activities.

FR-COMP-009a governs Evidence generated for inclusion in a Security Control Traceability Matrix.

FR-COMP-009c governs Evidence generated for use in Authorization to Operate activities.

This requirement does not assign RMF responsibilities to Crucible. RMF participants remain responsible for control selection, implementation decisions, assessment, risk management, authorization, and monitoring decisions.

Do not add Security Control selection, control approval, assessment authority, risk acceptance, authorization, or operational approval responsibilities unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>