====== Compliance Provider ====== [[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] ===== Discussion ===== A Compliance Provider is a software component or service that performs compliance-related operations through a defined provider-independent contract. The Compliance Provider may select or invoke assessment tooling, process machine-readable benchmarks, execute checks, apply remediation, parse native results, and transform those results into a common findings representation. A Compliance Provider isolates scanner-specific commands, formats, terminology, and behavior from the compliance functions that consume normalized results and generate evidence. Within Crucible, an OpenSCAP Compliance Provider invokes OpenSCAP, processes the resulting assessment content, and supplies normalized findings to the compliance engine. ===== Definition ===== //software component or service that performs compliance-related operations through a defined provider-independent contract// ===== Source ===== Generalized from provider abstraction, plugin architecture, compliance automation, scanner integration, and software-adapter usage and specialized for the Crucible architecture and operational model. ===== Note ===== A Compliance Provider is not the authority that establishes the applicable compliance criteria or grants accreditation or operational approval. Different Compliance Providers may support different benchmarks, scanners, operating systems, result formats, or remediation mechanisms while conforming to the same provider-independent contract. ===== Example ===== A Crucible Compliance Provider invokes OpenSCAP to assess a [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 Hardened Image against a selected [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] profile and converts the native results into normalized findings. ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.