Within a Connected Environment, Crucible constructs controlled Images and assesses identified subjects against applicable compliance criteria.
Connectivity provides access to the authorized resources required by the applicable construction and assessment activities. The Image Management and Compliance Management requirements define the capabilities performed. Connected operation does not establish a separate source-access capability.
Crucible uses the applicable controlled inputs for the selected construction or assessment activity.
Construction inputs can include:
Assessment inputs can include:
The applicable lifecycle definition identifies the inputs required for each activity.
Crucible constructs an identified Machine Image or Container Image from the selected controlled inputs.
The construction activity can include:
When a required change affects a deployed immutable Image, Crucible constructs a replacement Image rather than modifying the deployed Image in place.
Image construction does not independently establish compliance or authorization for deployment.
Crucible identifies the compliance criteria applicable to the assessment subject.
The criteria can derive from:
The responsible organization determines which compliance criteria apply to the assessment subject.
Crucible integrates with an applicable compliance-scanning or assessment tool and evaluates the identified subject against the selected compliance criteria.
The assessment activity can include:
The compliance-scanning abstraction separates the assessment activity from a particular operating system or scanning product.
Support for multiple operating systems does not require every assessment provider to support every operating system.
The assessment result identifies the relationship between the assessed subject and the applicable compliance criteria.
The result can include:
Crucible generates Evidence that can support Security Control Traceability Matrix, Risk Management Framework, and Authority to Operate activities.
Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.
The connected construction and assessment activities produce identifiable results that can include:
The applicable lifecycle activity determines which results Crucible produces.
The linked leaf requirement pages remain the canonical sources.
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.