====== Compliance Finding ====== [[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] ===== Discussion ===== A Compliance Finding is a recorded result produced by evaluating a specified subject against an applicable compliance criterion. The finding may record satisfaction, non-satisfaction, non-applicability, inability to determine, execution error, or another result permitted by the applicable assessment method. A Compliance Finding may identify the evaluated criterion, subject, benchmark and profile versions, assessment time, method, observed value, expected value, severity, rationale, remediation information, and supporting [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]. Within Crucible, a Compliance Provider may produce scanner-specific findings that the compliance engine transforms into a common or normalized findings representation. ===== Definition ===== //recorded result produced by evaluating a specified subject against an applicable compliance criterion// ===== Source ===== Generalized from conformity assessment, security assessment, audit, control evaluation, and compliance-scanning usage and specialized for the Crucible architecture and operational model. ===== Note ===== A Compliance Finding records the result for a single criterion or a bounded evaluation. A collection of Compliance Findings supports a broader determination of compliance. A finding of non-satisfaction does not by itself determine the acceptability of the associated risk. The applicable governance and authorization process evaluates the finding, context, remediation, exceptions, and residual risk. ===== Example ===== An assessment evaluates a [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 Machine Image against a [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] rule requiring a specified audit configuration. The resulting Compliance Finding records whether the image satisfies the rule and preserves the observed configuration and supporting evidence. ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.