====== Compliance Benchmark ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

A Compliance Benchmark is a defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance|Compliance]] for a specified subject and operating context.

The benchmark may apply to an operating system, application, service, [[dido:99_annexes:annex-b-terms-and-definitions:p:platform|Platform]], [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]], infrastructure environment, or organizational process.

A Compliance Benchmark may identify individual rules, severity levels, control references, applicability conditions, assessment methods, remediation guidance, and expected evidence.

A [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] can serve as a Compliance Benchmark for a defined product or technology. Within Crucible, the selected benchmark forms part of the applicable [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] and [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]].

===== Definition =====

//defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine compliance for a specified subject and operating context//

===== Source =====

Generalized from conformity assessment, cybersecurity, configuration assessment, quality management, and regulatory-compliance usage and specialized for the Crucible architecture and operational model.

===== Note =====

A Compliance Benchmark should identify its issuing authority, version, applicable subject, scope, and assessment context.

Applying a Compliance Benchmark does not establish compliance unless the assessment evaluates the applicable criteria and records the resulting findings and evidence.

===== Example =====

A Crucible Image Baseline selects a [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 as the Compliance Benchmark for a Hardened Image.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>