Annex D: Requirements Traceability

Annex D: Requirements Traceability

Annex D maps the canonical leaf requirements in Annex C: Requirements to the Crucible pages that reference them.

Annex C remains the canonical source for requirement titles, Statements, rationale, and verification information. Annex D provides traceability links and coverage information without restating or redefining the requirements.

Requirements Traceability Index

The Requirements Traceability Index lists the canonical leaf requirements alphabetically by title.

The Requirement Title column links to the canonical requirement page. The Referenced By column identifies the Crucible pages that link to that requirement.

A requirement with no references requires review to determine whether:

The requirement lacks ConOps coverage
The requirement belongs outside the ConOps
The requirement represents a future capability
The requirement page or backlink is incomplete
The requirement requires an additional operational page

Requirement Title	Referenced By
MO-005f — Approved Infrastructure Baseline Preservation	MO-005a — Infrastructure Baseline Artifact Management MO-005b — Infrastructure Baseline Identification MO-005c — Infrastructure Baseline Revision Control MO-005d — Approved Infrastructure Baseline Selection MO-005e — Infrastructure Baseline Reuse MO-005g — Infrastructure Deployment Baseline Traceability
MO-005d — Approved Infrastructure Baseline Selection	MO-005a — Infrastructure Baseline Artifact Management MO-005b — Infrastructure Baseline Identification MO-005c — Infrastructure Baseline Revision Control MO-005e — Infrastructure Baseline Reuse MO-005f — Approved Infrastructure Baseline Preservation MO-005g — Infrastructure Deployment Baseline Traceability
FR-AG-002 — Artifact Export Packages	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 4.3 External Systems 7.4 Import the Transfer Bundle C.3.5 Air-Gapped Operations
FR-AG-003 — Artifact Import Packages	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 4.3 External Systems 7.4 Import the Transfer Bundle C.3.5 Air-Gapped Operations
FR-COMP-009c — Authorization to Operate Evidence	5.4 Assess Compliance 5.7 Preserve Evidence and Lifecycle Records 6.1 Construct and Assess the Environment 8.4 Generate Supporting Evidence
MO-004c — Authorized Resource Use	3.1 Connectivity Conditions 4.3 External Systems MO-004a — Connected Environment Operations MO-004b — Disconnected Environment Operations MO-004d — Disconnected Resource Availability
FR-DSO-004 — Automated Build Execution	Plugin Backlinks: Nothing was found.
FR-DSO-005 — Automated Deployment Execution	Plugin Backlinks: Nothing was found.
FR-DSO-006 — Automated Validation Execution	Plugin Backlinks: Nothing was found.
FR-AG-004 — Baseline Synchronization	C.3.5 Air-Gapped Operations
FR-IMG-002 — Build Container Images	5.2 Construct Images 6.1 Construct and Assess the Environment 7.6 Rebuild and Deploy
FR-IMG-001 — Build Virtual Machine Images	5.2 Construct Images 6.1 Construct and Assess the Environment 7.6 Rebuild and Deploy
FR-DEPC-001 — Capture Build Dependencies	5.3 Capture and Preserve Dependencies 7.1 Capture and Preserve Dependencies
FR-DSO-003 — CI/CD Pipeline Integration	Plugin Backlinks: Nothing was found.
OR-003a — Classified Environment Operations	3.3 Security Domains and Transfer Boundaries
FR-MC-001 — Cloud Provider Abstraction	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment
FR-UI-002 — Command-Line Interface	9.2 Command-Line Interface C.3.11 Crucible Interfaces
MO-001e — Compliance Baseline Conformance	MO-001a — Infrastructure Environment Creation MO-001b — Deployment Duration MO-001c — Reproducibility MO-001d — Security Baseline Conformance
FR-COMP-001 — Compliance Baseline Definitions	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.1 Select Compliance Criteria and Baselines
FR-COMP-004 — Compliance Evidence Artifacts	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.4 Generate Supporting Evidence
FR-COMP-010b — Compliance Finding Association Preservation	5.4 Assess Compliance 5.7 Preserve Evidence and Lifecycle Records 6.1 Construct and Assess the Environment 7.7 Preserve Traceability Across Environments 8.5 Transfer Compliance Findings
FR-COMP-010a — Compliance Finding Transfer Bundle Inclusion	5.4 Assess Compliance 5.7 Preserve Evidence and Lifecycle Records 6.1 Construct and Assess the Environment 7.2 Produce the Transfer Bundle 8.5 Transfer Compliance Findings
OR-001f — Compliance Officer Operations	OR-001a — Developer Operations OR-001b — DevSecOps Engineer Operations OR-001c — Platform Engineer Operations OR-001d — System Administrator Operations OR-001e — Security Engineer Operations
FR-COMP-003 — Compliance Reporting	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.3 Produce Compliance Reports
FR-COMP-008a — Compliance Scanning Abstraction	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.2 Perform Compliance Assessments
FR-COMP-002 — Compliance Scanning Tool Integration	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.2 Perform Compliance Assessments
FR-BAS-002 — Compose Selected Baselines	5.1 Select and Compose Baselines
OR-004a — Concurrent Environment Deployment	OR-004 — Concurrent Environment Deployment and Management
OR-004b — Concurrent Environment Management	OR-004 — Concurrent Environment Deployment and Management
FR-CFG-005 — Configuration Version History	Plugin Backlinks: Nothing was found.
MO-004a — Connected Environment Operations	3.1 Connectivity Conditions MO-004b — Disconnected Environment Operations MO-004c — Authorized Resource Use MO-004d — Disconnected Resource Availability
FR-BAS-001 — Consume Baseline Repositories from a Workspace	5.1 Select and Compose Baselines
OR-003f — Cross-Domain Transfer Control	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 7.3 Transfer Across the Boundary 7.4 Import the Transfer Bundle
MO-003a — Cross-Platform Deployment	3.2 Deployment Environments MO-003b — Provider-Independent Crucible Description MO-003c — Provider-Independent Infrastructure Baseline MO-003d — Limitation of Provider-Specific Dependencies
FR-COMP-007 — Custom Compliance Frameworks	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.1 Select Compliance Criteria and Baselines
FR-CFG-001 — Declarative Infrastructure Configuration	Plugin Backlinks: Nothing was found.
FR-DEPC-005 — Dependency Store Implementation Independence	5.3 Capture and Preserve Dependencies 7.1 Capture and Preserve Dependencies
FR-DEP-004 — Deploy Containerized Workloads	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment 7.6 Rebuild and Deploy
FR-DEP-001 — Deploy Infrastructure Resources	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment 7.6 Rebuild and Deploy
FR-DEP-003 — Deploy Kubernetes Clusters	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment 7.6 Rebuild and Deploy
FR-DEP-005 — Deploy Platform Services	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment 7.6 Rebuild and Deploy
FR-DEP-002 — Deploy Virtual Machines	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment 7.6 Rebuild and Deploy
OR-002b — Deployment Acceptance Assessment	Plugin Backlinks: Nothing was found.
OR-002c — Deployment Acceptance Record	Plugin Backlinks: Nothing was found.
MO-001b — Deployment Duration	MO-001a — Infrastructure Environment Creation MO-001c — Reproducibility MO-001d — Security Baseline Conformance MO-001e — Compliance Baseline Conformance
FR-MC-003 — Deployment Portability Across Cloud Providers	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment
FR-DEP-006 — Deployment Rollback	Plugin Backlinks: Nothing was found.
OR-002a — Deployment to a Supported Target	3.1 Connectivity Conditions 3.2 Deployment Environments
FR-AG-005 — Deployment Traceability Across Disconnected Environments	3.3 Security Domains and Transfer Boundaries 7.4 Import the Transfer Bundle C.3.5 Air-Gapped Operations
FR-DEP-007 — Deployment Validation	5.6 Validate the Result
OR-001a — Developer Operations	OR-001b — DevSecOps Engineer Operations OR-001c — Platform Engineer Operations OR-001d — System Administrator Operations OR-001e — Security Engineer Operations OR-001f — Compliance Officer Operations
OR-001b — DevSecOps Engineer Operations	OR-001a — Developer Operations OR-001c — Platform Engineer Operations OR-001d — System Administrator Operations OR-001e — Security Engineer Operations OR-001f — Compliance Officer Operations
FR-COMP-005 — DISA STIG Compliance Baselines	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.1 Select Compliance Criteria and Baselines
FR-AG-001 — Disconnected Deployment Operations	C.3.5 Air-Gapped Operations
MO-004b — Disconnected Environment Operations	3.1 Connectivity Conditions MO-004a — Connected Environment Operations MO-004c — Authorized Resource Use MO-004d — Disconnected Resource Availability
MO-004d — Disconnected Resource Availability	3.1 Connectivity Conditions 4.3 External Systems MO-004a — Connected Environment Operations MO-004b — Disconnected Environment Operations MO-004c — Authorized Resource Use
or-005	Plugin Backlinks: Nothing was found.
FR-MC-005 — Edge Deployments	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment
FR-CFG-004 — Environment Inheritance	Plugin Backlinks: Nothing was found.
FR-COMP-006 — FedRAMP Baseline Definitions	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.1 Select Compliance Criteria and Baselines
FR-DSO-001 — Git-Based Workflow Integration	Plugin Backlinks: Nothing was found.
FR-DSO-002 — GitOps Workflow Integration	Plugin Backlinks: Nothing was found.
FR-MC-004 — Hybrid-Cloud Deployments	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment
FR-IMG-006 — Image Promotion Workflows	5.2 Construct Images 6.1 Construct and Assess the Environment
FR-IMG-004 — Image Signing	5.2 Construct Images 6.1 Construct and Assess the Environment
FR-IMG-005 — Image Verification	5.2 Construct Images 6.1 Construct and Assess the Environment
FR-IMG-003 — Immutable Infrastructure Workflows	5.2 Construct Images 6.1 Construct and Assess the Environment
OR-003e — Information Handling Rule Enforcement	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 7.3 Transfer Across the Boundary 7.4 Import the Transfer Bundle
FR-CFG-002 — Infrastructure as Code	Plugin Backlinks: Nothing was found.
MO-005a — Infrastructure Baseline Artifact Management	MO-005b — Infrastructure Baseline Identification MO-005c — Infrastructure Baseline Revision Control MO-005d — Approved Infrastructure Baseline Selection MO-005e — Infrastructure Baseline Reuse MO-005f — Approved Infrastructure Baseline Preservation MO-005g — Infrastructure Deployment Baseline Traceability
MO-005b — Infrastructure Baseline Identification	MO-005a — Infrastructure Baseline Artifact Management MO-005c — Infrastructure Baseline Revision Control MO-005d — Approved Infrastructure Baseline Selection MO-005e — Infrastructure Baseline Reuse MO-005f — Approved Infrastructure Baseline Preservation MO-005g — Infrastructure Deployment Baseline Traceability
MO-005e — Infrastructure Baseline Reuse	MO-005a — Infrastructure Baseline Artifact Management MO-005b — Infrastructure Baseline Identification MO-005c — Infrastructure Baseline Revision Control MO-005d — Approved Infrastructure Baseline Selection MO-005f — Approved Infrastructure Baseline Preservation MO-005g — Infrastructure Deployment Baseline Traceability
MO-005c — Infrastructure Baseline Revision Control	MO-005a — Infrastructure Baseline Artifact Management MO-005b — Infrastructure Baseline Identification MO-005d — Approved Infrastructure Baseline Selection MO-005e — Infrastructure Baseline Reuse MO-005f — Approved Infrastructure Baseline Preservation MO-005g — Infrastructure Deployment Baseline Traceability
MO-005g — Infrastructure Deployment Baseline Traceability	MO-005a — Infrastructure Baseline Artifact Management MO-005b — Infrastructure Baseline Identification MO-005c — Infrastructure Baseline Revision Control MO-005d — Approved Infrastructure Baseline Selection MO-005e — Infrastructure Baseline Reuse MO-005f — Approved Infrastructure Baseline Preservation
MO-001a — Infrastructure Environment Creation	MO-001b — Deployment Duration MO-001c — Reproducibility MO-001d — Security Baseline Conformance MO-001e — Compliance Baseline Conformance
MO-006e — Infrastructure Environment Retirement	MO-006a — Operational Lifecycle Association MO-006b — Infrastructure Lifecycle Initiation MO-006c — Infrastructure Lifecycle State Recording MO-006d — Infrastructure Lifecycle Transition Execution
MO-006b — Infrastructure Lifecycle Initiation	MO-006a — Operational Lifecycle Association MO-006c — Infrastructure Lifecycle State Recording MO-006d — Infrastructure Lifecycle Transition Execution MO-006e — Infrastructure Environment Retirement
MO-006c — Infrastructure Lifecycle State Recording	MO-006a — Operational Lifecycle Association MO-006b — Infrastructure Lifecycle Initiation MO-006d — Infrastructure Lifecycle Transition Execution MO-006e — Infrastructure Environment Retirement
MO-006d — Infrastructure Lifecycle Transition Execution	MO-006a — Operational Lifecycle Association MO-006b — Infrastructure Lifecycle Initiation MO-006c — Infrastructure Lifecycle State Recording MO-006e — Infrastructure Environment Retirement
MO-003d — Limitation of Provider-Specific Dependencies	3.2 Deployment Environments 4.3 External Systems MO-003a — Cross-Platform Deployment MO-003b — Provider-Independent Crucible Description MO-003c — Provider-Independent Infrastructure Baseline
MO-002a — Maximum Platform Deployment Duration	MO-002b — Platform Deployment Duration Reduction
FR-COMP-008b — Multiple Operating-System Support	5.4 Assess Compliance 6.1 Construct and Assess the Environment 8.2 Perform Compliance Assessments
MO-006a — Operational Lifecycle Association	MO-006b — Infrastructure Lifecycle Initiation MO-006c — Infrastructure Lifecycle State Recording MO-006d — Infrastructure Lifecycle Transition Execution MO-006e — Infrastructure Environment Retirement
FR-BAS-004 — Perform Noninteractive Workspace Execution	5.1 Select and Compose Baselines
MO-002b — Platform Deployment Duration Reduction	MO-002a — Maximum Platform Deployment Duration
OR-001c — Platform Engineer Operations	OR-001a — Developer Operations OR-001b — DevSecOps Engineer Operations OR-001d — System Administrator Operations OR-001e — Security Engineer Operations OR-001f — Compliance Officer Operations
FR-DEPC-004 — Populate Offline Repositories	5.3 Capture and Preserve Dependencies 7.5 Populate Offline Repositories 7.6 Rebuild and Deploy
FR-DEPC-002 — Preserve Dependencies in a Dependency Store	5.3 Capture and Preserve Dependencies 7.1 Capture and Preserve Dependencies
FR-BAS-003 — Process Predeployment and Postdeployment Steps	5.1 Select and Compose Baselines
FR-DEPC-003 — Produce a Transfer Bundle	5.3 Capture and Preserve Dependencies 7.2 Produce the Transfer Bundle
MO-003b — Provider-Independent Crucible Description	3.2 Deployment Environments MO-003a — Cross-Platform Deployment MO-003c — Provider-Independent Infrastructure Baseline MO-003d — Limitation of Provider-Specific Dependencies
MO-003c — Provider-Independent Infrastructure Baseline	3.2 Deployment Environments MO-003a — Cross-Platform Deployment MO-003b — Provider-Independent Crucible Description MO-003d — Limitation of Provider-Specific Dependencies
FR-MC-002 — Provider-Specific Extensions	3.2 Deployment Environments 5.5 Deploy the Environment 6.2 Deploy in a Connected Environment
MO-001c — Reproducibility	MO-001a — Infrastructure Environment Creation MO-001b — Deployment Duration MO-001d — Security Baseline Conformance MO-001e — Compliance Baseline Conformance
FR-CFG-003 — Reusable Infrastructure Blueprints	Plugin Backlinks: Nothing was found.
FR-COMP-009b — Risk Management Framework Evidence	5.4 Assess Compliance 5.7 Preserve Evidence and Lifecycle Records 6.1 Construct and Assess the Environment 8.4 Generate Supporting Evidence
MO-001d — Security Baseline Conformance	MO-001a — Infrastructure Environment Creation MO-001b — Deployment Duration MO-001c — Reproducibility MO-001e — Compliance Baseline Conformance
FR-COMP-009a — Security Control Traceability Matrix Evidence	5.4 Assess Compliance 5.7 Preserve Evidence and Lifecycle Records 6.1 Construct and Assess the Environment 8.4 Generate Supporting Evidence
OR-003g — Security Domain Access Control	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 4.3 External Systems
OR-003d — Security Domain Information Enforcement	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 4.3 External Systems 7.3 Transfer Across the Boundary 7.4 Import the Transfer Bundle
OR-003c — Security Domain Resource Enforcement	3.3 Security Domains and Transfer Boundaries 4.1 Human Actors 4.3 External Systems
OR-001e — Security Engineer Operations	OR-001a — Developer Operations OR-001b — DevSecOps Engineer Operations OR-001c — Platform Engineer Operations OR-001d — System Administrator Operations OR-001f — Compliance Officer Operations
FR-UI-001 — Shared Interface Operations	9.1 Shared Interface Operations C.3.11 Crucible Interfaces
OR-001d — System Administrator Operations	OR-001a — Developer Operations OR-001b — DevSecOps Engineer Operations OR-001c — Platform Engineer Operations OR-001e — Security Engineer Operations OR-001f — Compliance Officer Operations
OR-003b — Unclassified Environment Operations	3.3 Security Domains and Transfer Boundaries
FR-UI-003 — Web-Based User Interface	9.3 Web-Based User Interface C.3.11 Crucible Interfaces

Notes for Editors

Each requirement title is displayed from the canonical requirement page
Do not add custom display text to requirement links
Confirm the canonical page title and namespace for each requirement
Add every remaining Annex C leaf requirement
Exclude true parent requirements that contain child requirements
Retain start for leaf requirements implemented as namespace index pages
Sort the completed table alphabetically by the displayed canonical page title
Treat a requirement with no returned backlinks as requiring coverage review

Notes for Editors

Confirm each displayed title against the canonical requirement page
Add every remaining Annex C leaf requirement
Exclude parent requirements that contain child requirements
Retain start for leaf requirements implemented as namespace index pages
Sort the final table alphabetically by canonical displayed title
A requirement with no returned backlinks requires coverage review

Traceability Rules

The traceability information follows these rules:

Include only canonical leaf requirements
Treat a requirement implemented as a namespace start page as a leaf when it has no child requirements
Exclude parent requirements that have leaf children
Link each requirement title to its canonical Annex C page
Sort the Requirements Traceability Index alphabetically by displayed title
Identify every Crucible page that directly references the requirement
Do not copy or paraphrase the canonical requirement Statement
Record requirements without references as uncovered until reviewed
Record ConOps pages without supporting requirements as unsupported until reviewed

Coverage Status

Detailed traceability pages can use the following coverage statuses:

Status	Meaning
Complete	The referenced Crucible content provides operational coverage consistent with the requirement Statement
Partial	The referenced content addresses only part of the requirement Statement
Not Covered	No current Crucible page provides identifiable coverage
Outside ConOps Scope	The requirement applies to another specification, design, implementation, verification, or governance artifact
Future Capability	The requirement applies to a capability outside the current operational baseline
Review Required	The available requirement or coverage information is insufficient to determine the appropriate status

Relationship to Annex E

Annex E: Issues records problems discovered during traceability review.

Examples include:

A requirement without operational coverage
A ConOps capability without a supporting requirement
A requirement that requires further decomposition
An ambiguous or incomplete requirement Statement
An incorrect parent or leaf classification
A missing requirement page
An inconsistent requirement namespace or title
A proposed future capability

Annex D records the traceability condition. Annex E records the issue and its resolution status.

Notes for Editors

Populate the Requirements Traceability Index only after confirming the complete Annex C leaf-requirement inventory.

Do not list true parent requirements when their leaf children provide the normative Statements.

Where a leaf requirement uses a namespace start page for numerical ordering, link to the actual start page.

The Referenced By column should derive from direct links to the canonical requirement page wherever the available DokuWiki backlink mechanism permits dynamic generation.

Table of Contents

Annex D: Requirements Traceability

Requirements Traceability Index

Notes for Editors

Notes for Editors

Contents

Traceability Rules

Coverage Status

Relationship to Annex E

Notes for Editors