====== FR-COMP-010b — Compliance Finding Association Preservation ======

[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:start|Go to FR-COMP-010 — Transferable Compliance Findings]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL preserve the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies when transferring them in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]].

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:start|FR-COMP-010 — Transferable Compliance Findings]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-010

The Original Requirement states:

> //The system shall capture [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|compliance findings]] into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

FR-COMP-010b:

  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Changes **shall** to the established uppercase normative form **SHALL**
  * Extracts preservation of the association between [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] and affected Artifacts as an independently verifiable requirement
  * Replaces **transferable dependency/evidence bundle** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]
  * Replaces **connected build** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]]
  * Replaces **disconnected enclave** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]
  * Assigns inclusion of Compliance Findings and affected Artifacts in the same Transfer Bundle to FR-COMP-010a

===== Rationale =====

A [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] remains useful after transfer only when its association with the evaluated [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] remains identifiable.

Preserving this association enables actors and processes in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] to determine which [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] apply to each transferred Artifact.

FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. This requirement governs preservation of the association between them.

This requirement does not require Crucible to:

  * Generate [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]]
  * Validate Compliance Findings
  * Resolve Compliance Findings
  * Remediate affected Artifacts
  * Reassess affected Artifacts
  * Determine whether affected Artifacts comply with a Compliance Baseline

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundles]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environments]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environments]]

===== Verification =====

Verification confirms that:

  - An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] with one or more associated [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] is selected for testing
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] includes the selected Artifact and its associated Compliance Findings in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]
  - Crucible transfers the Transfer Bundle from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]
  - The transferred Artifact can be identified in the Disconnected Environment
  - Each transferred Compliance Finding can be identified in the Disconnected Environment
  - The association between each transferred Compliance Finding and the Artifact to which it applies can be determined in the Disconnected Environment

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Implementation Status =====

Implemented and Verified

===== Requirement Status =====

<todo>Review and approve FR-COMP-010b as a leaf requirement.</todo>

----
===== Issues =====

<todo>Confirm the controlled definition of Compliance Finding in the shared Terms and Definitions corpus.</todo>

<todo>Determine whether separate requirements define the identifier or reference mechanism used to preserve the association between a Compliance Finding and an Artifact.</todo>

<todo>Determine whether separate requirements govern verification of the preserved association after Transfer Bundle import.</todo>

----
===== Notes for Editors =====

This requirement page retains the derived requirement identifier ''FR-COMP-010b''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

The Statement addresses only preservation of the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies during transfer between Connected and Disconnected Environments.

FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]].

Use the following controlling Terms and Definitions entry for Compliance Finding:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]]

Do not add finding generation, validation, resolution, remediation, reassessment, identifier-format, or compliance-decision obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>