====== Compliance ====== [[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] ===== Discussion ===== Compliance is the condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria. A Compliance determination depends on the defined: * Subject * Applicable criteria * Controlling sources * Controlling source [[dido:99_annexes:annex-b-terms-and-definitions:v:version|Versions]] * Scope * Operating context * Assessment method * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] * Time of evaluation * Applicable [[dido:99_annexes:annex-b-terms-and-definitions:a:authority|Authority]] Compliance can apply to: * A [[dido:99_annexes:annex-b-terms-and-definitions:c:candidate_solution|Candidate Solution]] * A [[dido:99_annexes:annex-b-terms-and-definitions:d:distributed_system|Distributed System]] * A system * A service * A process * An [[dido:99_annexes:annex-b-terms-and-definitions:o:organization|Organization]] * An [[dido:99_annexes:annex-b-terms-and-definitions:a:actor|Actor]] * A [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]] * A [[dido:99_annexes:annex-b-terms-and-definitions:q:qualified_node|Qualified Node]] * A [[dido:99_annexes:annex-b-terms-and-definitions:n:node_set|Node Set]] * An artifact * A [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration|Configuration]] * A [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]] * An individual control * Another subject governed by applicable criteria A subject can comply with one set of criteria while failing to comply with another. Applicable criteria can originate from: * [[dido:99_annexes:annex-b-terms-and-definitions:r:requirement|Requirements]] * Laws * Regulations * Contracts * Agreements * [[dido:99_annexes:annex-b-terms-and-definitions:g:governance_policy|Governance Policies]] * Standards * Specifications * Controls * Benchmarks * Decisions of an applicable Authority * Other controlling sources A Compliance evaluation can result in a determination such as: * Satisfied * Not satisfied * Partially satisfied * Not applicable * Not evaluated * Inconclusive * Another status established by the applicable criteria The controlling source, Governance Policy, [[dido:99_annexes:annex-b-terms-and-definitions:v:validation_criteria|Validation Criteria]], or [[dido:99_annexes:annex-b-terms-and-definitions:a:acceptance_criteria|Acceptance Criteria]] establishes the permitted Compliance determinations. Compliance differs from [[dido:99_annexes:annex-b-terms-and-definitions:a:accreditation|Accreditation]]. Compliance establishes satisfaction of specified criteria, while Accreditation provides formal recognition within a defined scope and operating context. ===== Definition ===== //condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria// ===== Source ===== Generalized from: * Conformity assessment * Governance * Risk management * Regulatory practice * Security engineering * Quality management Specialized for: * Crucible architecture and operations * DIDO Reference Architecture * DIDO Reference Implementation Conceptual Model * DIDO-TE comparative evaluation and Validation The original definition and its approved intent are preserved. ===== Note ===== Compliance is not an absolute property without a stated reference. A Compliance claim should identify: * The subject * The applicable criteria * The controlling source * The controlling source Version * The evaluation scope * The operating context * The assessment method * The evaluation time * The applicable Authority * The supporting Evidence Evidence supports a Compliance determination but does not by itself establish that the subject satisfies the applicable criteria. Compliance differs from [[dido:99_annexes:annex-b-terms-and-definitions:e:evaluation_characteristic|Evaluation Characteristic]]: * An Evaluation Characteristic identifies a characteristic selected for measurement, observation, comparison, or evaluation * Compliance identifies the condition of satisfying applicable criteria A comparative evaluation can evaluate the Compliance of multiple Candidate Solutions, but Compliance does not become a Quality Characteristic solely because it participates in the evaluation. Compliance differs from [[dido:99_annexes:annex-b-terms-and-definitions:s:security|Security]]: * Compliance concerns satisfaction of applicable criteria * Security concerns protection of information, operations, and Resources according to applicable authorization and security constraints A subject can satisfy specified security criteria while retaining security risks not addressed by those criteria. A subject can implement effective security controls but fail Compliance because it does not satisfy an applicable documentation, authorization, reporting, retention, or Evidence obligation. Compliance differs from a [[dido:99_annexes:annex-b-terms-and-definitions:v:verdict|Verdict]]: * Compliance identifies a condition relative to applicable criteria * A Verdict records an evaluation assigned to a [[dido:99_annexes:annex-b-terms-and-definitions:t:test_result|Test Result]] Multiple Test Results and Verdicts can support one Compliance determination. Compliance differs from a [[dido:99_annexes:annex-b-terms-and-definitions:v:validation_decision|Validation Decision]]: * Compliance identifies the condition of satisfying applicable criteria * A Validation Decision records a determination produced by evaluating information against Validation Criteria A Validation Decision can establish or support the Compliance status of a subject. An approved exception, waiver, or deviation does not erase the underlying criterion. The Compliance record should preserve: * The underlying criterion * The approved exception, waiver, or deviation * The approving Authority * The approval period * The approval conditions * The supporting Evidence * The applicable [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] * The applicable [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] ===== Example ===== A Hardened Image satisfies the applicable requirements of a selected [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] profile at the time of assessment. The Compliance claim applies to: * The identified Hardened Image * The selected STIG profile * The STIG profile Version * The recorded Configuration * The assessment scope * The assessment method * The evaluation time * The supporting Evidence In a DIDO-TE comparative evaluation, three Candidate Solutions are evaluated against the same regulatory, security, retention, audit, interoperability, and Evidence-preservation criteria. [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]] preserves Traceability among each Candidate Solution, applicable criterion, controlling source, Test Definition, Test Result, Verdict, Compliance determination, and supporting Evidence. ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.