A Compliance Finding is a recorded result produced by evaluating a specified subject against an applicable compliance criterion.
The finding may record satisfaction, non-satisfaction, non-applicability, inability to determine, execution error, or another result permitted by the applicable assessment method.
A Compliance Finding may identify the evaluated criterion, subject, benchmark and profile versions, assessment time, method, observed value, expected value, severity, rationale, remediation information, and supporting Evidence.
Within Crucible, a Compliance Provider may produce scanner-specific findings that the compliance engine transforms into a common or normalized findings representation.
recorded result produced by evaluating a specified subject against an applicable compliance criterion
Generalized from conformity assessment, security assessment, audit, control evaluation, and compliance-scanning usage and specialized for the Crucible architecture and operational model.
A Compliance Finding records the result for a single criterion or a bounded evaluation. A collection of Compliance Findings supports a broader determination of compliance.
A finding of non-satisfaction does not by itself determine the acceptability of the associated risk. The applicable governance and authorization process evaluates the finding, context, remediation, exceptions, and residual risk.
An assessment evaluates a Red Hat Enterprise Linux (RHEL) 9 Machine Image against a Security Technical Implementation Guide (STIG) rule requiring a specified audit configuration. The resulting Compliance Finding records whether the image satisfies the rule and preserves the observed configuration and supporting evidence.
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.