The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).[C1]
The Original Requirement contains two distinct normative obligations:
These obligations require separate verification and therefore should be represented by separate leaf requirements.
The parenthetical reference to the current OpenSCAP and RHEL 9 integration identifies an implementation example. It does not establish an additional normative obligation and should not appear in a child requirement Statement.
The phrase operating-system-agnostic is replaced with operating-system-independent to align the requirement title and avoid implying complete absence of operating-system-specific implementation components.
Review and approve the decomposition of FR-COMP-008.
Create and approve FR-COMP-008a.
Create and approve FR-COMP-008b.
Determine whether Compliance Scanning Abstraction requires a controlled definition in the shared Terms and Definitions corpus.
Determine whether Operating System requires a controlled definition in the shared Terms and Definitions corpus.
Determine whether the minimum of two operating systems accurately expresses the intended portability threshold.
This page is a non-leaf requirement page and therefore retains a trailing :start in its namespace.
The child requirements are leaf pages and omit a trailing :start from their namespaces.
The OpenSCAP and RHEL 9 reference describes one implementation of the abstraction and does not create a requirement to use either technology.
Do not add requirements for dynamic provider loading, plugin discovery, provider registration, common result formats, or automatic operating-system detection unless the controlling source adds those obligations.
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.