MO-001e — Compliance Baseline Conformance

Go to MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

Crucible SHALL create an Infrastructure Environment that conforms to the selected Compliance Baseline.

This requirement derives from:

• MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

The Original Requirement states:

Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.[C1]

MO-001e preserves the portion of the Original Requirement that characterizes Infrastructure Environments as compliant by requiring each created Infrastructure Environment to conform to the selected Compliance Baseline.

The separate requirements derived from MO-001 address:

• MO-001a — Infrastructure Environment Creation
• MO-001b — Deployment Duration
• MO-001c — Reproducibility
• MO-001d — Security Baseline Conformance

The word compliant does not establish an objective compliance obligation unless a controlling Compliance Baseline identifies the requirements and conformance criteria used for evaluation.

The selected Compliance Baseline provides the controlled compliance requirements against which the created Infrastructure Environment is evaluated.

Compliance Baseline conformance supports:

• Consistent application of compliance requirements
• Objective evaluation of the created Infrastructure Environment
• Identification of unmet or incorrectly implemented requirements
• Evidence generation
• Provenance
• Traceability
• Independent review of compliance outcomes

Separating Compliance Baseline conformance from Infrastructure Environment creation permits Crucible to create an Infrastructure Environment while independently passing or failing the compliance requirement.

This requirement does not establish a deployment-duration threshold, reproducibility criterion, or Security Baseline. The other requirements derived from MO-001 address those outcomes.

This requirement applies to:

• Crucible
• Infrastructure Environments
• Compliance Baselines
• Compliance requirements
• Compliance evaluation
• Compliance findings
• Controlled Inputs
• Baselines
• Infrastructure Baselines
• Infrastructure Configurations
• Machine Images
• Image Layers
• Evidence
• Provenance
• Traceability
• Connected Environments
• Disconnected Environments
• Air-Gapped Environments

Verification confirms that:

1. The selected Compliance Baseline is identified
2. The Compliance Baseline identifies the compliance requirements and conformance criteria used for evaluation
3. The created Infrastructure Environment is evaluated against the selected Compliance Baseline
4. Each required compliance requirement is evaluated
5. The created Infrastructure Environment satisfies the conformance criteria defined by the selected Compliance Baseline
6. Any compliance finding is identified and associated with the affected compliance requirement
7. The verification record preserves Traceability among the selected Compliance Baseline, the evaluated compliance requirements, the created Infrastructure Environment, and the evaluation result

The following pages reference this requirement:

Implemented and Verified

Assess whether the current Crucible implementation creates Infrastructure Environments that conform to the selected Compliance Baseline.

Review and accept MO-001e as a proposed derived requirement created from the evaluation and decomposition of MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft.

The following unresolved issues affect this requirement:

Identify the controlling source that selects the Compliance Baseline for each Infrastructure Environment.

Identify the compliance requirements and conformance criteria that determine Compliance Baseline conformance.

Define how exceptions, deviations, waivers, and compensating measures affect Compliance Baseline conformance.

Define whether an Infrastructure Environment with unresolved compliance findings can satisfy this requirement.

This requirement page should retain the stable requirement identifier MO-001e.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The parent MO-001 page is a non-leaf page and retains a trailing :start in its namespace.

Changes to the Statement should preserve:

• Crucible as the responsible actor
• Creation of an Infrastructure Environment as the required outcome
• The selected Compliance Baseline as the controlling compliance source
• Conformance to the selected Compliance Baseline as the required compliance outcome

The unresolved Compliance Baseline selection and conformance criteria should remain recorded in the Issues section until a controlling source resolves them.

Material changes should receive review and should update the verification criteria, source records, and Issues section.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.