====== FR-COMP-009c — Authorization to Operate Evidence ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start|Go to FR-COMP-009 — Security-Control Implementation Evidence]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL generate Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] for use in [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]] activities.

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start|FR-COMP-009 — Security-Control Implementation Evidence]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-009

The Original Requirement states:

> //The system shall generate security-control implementation evidence suitable for supporting [[dido:99_annexes:annex-b-terms-and-definitions:s:sctm|SCTM]], [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|RMF]], and [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|ATO]] processes.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-009c:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Extracts generation of Security-Control Implementation Evidence for the ATO context as an independently verifiable requirement
  * Replaces the weak phrase **suitable for supporting ATO processes** with the direct purpose **for use in Authorization to Operate activities**
  * Assigns SCTM Evidence to FR-COMP-009a
  * Assigns RMF Evidence to FR-COMP-009b

===== Rationale =====

An [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]] records a risk-based management decision by an [[dido:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]] to permit a system to operate within a defined scope and to accept the associated residual risk.

Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] provides information that an Authorizing Authority and supporting participants can review when evaluating the implementation of Security Controls and the security posture of a system.

This requirement establishes generation of Security-Control Implementation Evidence for use in ATO activities without requiring Crucible to:

  * Approve a Security Control implementation
  * Determine whether a Security Control operates effectively
  * Perform the responsibilities of a control assessor
  * Determine the acceptability of residual risk
  * Make an authorization decision
  * Issue an ATO
  * Act as an Authorizing Authority
  * Define the duration, scope, conditions, or limitations of an ATO

Separate requirements, authorization procedures, evidence profiles, and governance processes govern those subjects and responsibilities.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Security-Control implementations
  * Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]] activities

===== Verification =====

Verification confirms that:

  - A Security Control implementation is selected for testing
  - An ATO activity requiring Security-Control Implementation Evidence is identified
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] generates Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] for the selected implementation
  - The generated Evidence identifies or references the Security Control implementation that the Evidence describes
  - The generated Evidence can be used as input to the identified ATO activity
  - The relationship between the generated Evidence and the identified ATO activity can be determined

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-009c as a leaf requirement.</todo>

----
===== Issues =====

<todo>Determine whether Security Control requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether Security-Control Implementation Evidence requires a controlled definition in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether separate requirements define the minimum identifiers, provenance, and references required for Evidence used in ATO activities.</todo>

<todo>Determine whether separate requirements identify the ATO activities for which Crucible must generate Evidence.</todo>

----
===== Notes for Editors =====

This requirement page retains the derived requirement identifier ''FR-COMP-009c''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The namespace for this requirement is:

''dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009c''

The Statement addresses only generation of Security-Control Implementation Evidence for use in Authorization to Operate activities.

FR-COMP-009a governs Evidence generated for inclusion in a Security Control Traceability Matrix.

FR-COMP-009b governs Evidence generated for use in Risk Management Framework activities.

This requirement does not assign authorization or risk-acceptance responsibilities to Crucible. The Authorizing Authority remains responsible for evaluating the available information, accepting residual risk, and issuing or denying an ATO.

Do not add Security Control approval, assessment authority, risk acceptance, authorization, ATO issuance, or operational approval responsibilities unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009c#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>