Crucible performs a Compliance Assessment by evaluating an identified subject against selected compliance criteria.
The assessed subject can include:
The assessment identifies the subject, applicable criteria, assessment provider, observed results, Compliance Findings, and supporting Evidence.
Crucible selects or receives the compliance criteria applicable to the assessed subject.
The criteria can derive from:
The selected criteria identify the conditions used to evaluate the subject. Crucible does not independently determine which legal, regulatory, contractual, or organizational obligations apply.
A Compliance Baseline defines a controlled set of compliance criteria applicable to one or more assessment subjects.
Crucible preserves:
Crucible can use established or organization-defined Compliance Baselines, including Baselines derived from DISA STIGs, FedRAMP, or other approved frameworks.
Support for a named framework does not cause Crucible to grant certification, authorization, or approval under that framework.
Crucible can integrate with one or more compliance-scanning or assessment tools through controlled provider interfaces.
An assessment provider performs provider-specific evaluation behavior while Crucible preserves the provider-independent assessment intent and lifecycle records.
The provider integration identifies:
The assessment abstraction is not limited to one operating system, assessment product, or provider implementation.
Different assessment providers can produce different native result formats. Crucible preserves sufficient information to relate each provider result to the assessed subject, selected criteria, and resulting Compliance Findings.
Crucible evaluates the identified subject against the selected compliance criteria using the applicable assessment provider.
The assessment process can include:
A Compliance Assessment evaluates the subject as it exists at the time of assessment. A later change to the subject, criteria, provider, or configuration can require another assessment.
A Compliance Finding records the result of evaluating an identified subject against an identified compliance criterion.
A finding can identify:
A finding reports the observed relationship between the subject and the criterion. The responsible authority determines whether the finding requires remediation, exception approval, risk acceptance, or another action.
Crucible produces a compliance report that presents the results of an identified Compliance Assessment.
The report can contain:
The report does not replace the underlying findings, provider results, or Evidence.
Crucible generates and preserves Evidence associated with the Compliance Assessment.
The Evidence can support:
Crucible provides supporting Evidence but does not grant Accreditation, Operational Approval, or an Authority to Operate (ATO).
A Compliance Assessment can occur in a Connected Environment, Disconnected Environment, or Air-Gapped Environment when the required criteria, assessment provider, dependencies, and supporting resources are available within the applicable boundary.
Compliance Findings produced during connected operation can accompany the artifacts they describe into a disconnected environment.
Crucible preserves the relationship among:
The transfer process does not change the meaning or status of a Compliance Finding. A subsequent change to the transferred artifact or its environment can require reassessment.
The Compliance Assessment result records:
The assessment result becomes an input to remediation, image promotion, deployment validation, transfer, authorization-supporting activities, or subsequent reassessment.
The linked leaf requirement pages remain the canonical sources.
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.