5.4 Assess Compliance

Go to 5. Operational Concept

Crucible performs a Compliance Assessment by evaluating an identified subject against selected compliance criteria.

The assessed subject can include:

A Machine ImageA Container ImageAn Infrastructure EnvironmentAn Infrastructure ConfigurationA deployed resource or workloadA BaselineAnother identified artifact or operational result governed by applicable compliance criteriaThe assessment identifies the subject, applicable criteria, assessment provider, observed results, Compliance Findings, and supporting Evidence.

Select Compliance Criteria

Crucible selects or receives the compliance criteria applicable to the assessed subject.

The criteria can derive from:

A Compliance BaselineA Compliance BenchmarkAn organizational policyA regulatory or contractual obligationAn approved security frameworkA user-defined compliance frameworkCriteria associated with a selected Deployment Target or Security DomainThe selected criteria identify the conditions used to evaluate the subject. Crucible does not independently determine which legal, regulatory, contractual, or organizational obligations apply.

Compliance Baselines

A Compliance Baseline defines a controlled set of compliance criteria applicable to one or more assessment subjects.

Crucible preserves:

The Compliance Baseline identifierThe selected revisionThe source or governing authorityThe subject types to which the Baseline appliesThe included criteriaApplicable parameters or profilesThe relationship between the Baseline and the assessed subjectCrucible can use established or organization-defined Compliance Baselines, including Baselines derived from DISA STIGs, FedRAMP, or other approved frameworks.

Support for a named framework does not cause Crucible to grant certification, authorization, or approval under that framework.

Assessment Providers

Crucible can integrate with one or more compliance-scanning or assessment tools through controlled provider interfaces.

An assessment provider performs provider-specific evaluation behavior while Crucible preserves the provider-independent assessment intent and lifecycle records.

The provider integration identifies:

The assessment providerThe provider implementation and revisionThe assessed subjectThe selected compliance criteriaProvider-specific parametersThe assessment invocationThe results returned by the providerThe assessment abstraction is not limited to one operating system, assessment product, or provider implementation.

Different assessment providers can produce different native result formats. Crucible preserves sufficient information to relate each provider result to the assessed subject, selected criteria, and resulting Compliance Findings.

Perform the Compliance Assessment

Crucible evaluates the identified subject against the selected compliance criteria using the applicable assessment provider.

The assessment process can include:

Identify the assessment subjectSelect the applicable Compliance Baseline or criteriaSelect an approved assessment providerSupply the required provider parametersExecute the assessmentReceive and preserve the provider resultsNormalize or relate the results to the applicable criteriaProduce Compliance FindingsGenerate the applicable report and supporting EvidenceA Compliance Assessment evaluates the subject as it exists at the time of assessment. A later change to the subject, criteria, provider, or configuration can require another assessment.

Compliance Findings

A Compliance Finding records the result of evaluating an identified subject against an identified compliance criterion.

A finding can identify:

The assessed subjectThe applicable criterionThe observed conditionThe assessment resultThe assessment providerThe assessment timeThe applicable severity or classificationSupporting EvidenceAn exception, waiver, or remediation reference, when applicableA finding reports the observed relationship between the subject and the criterion. The responsible authority determines whether the finding requires remediation, exception approval, risk acceptance, or another action.

Compliance Reports

Crucible produces a compliance report that presents the results of an identified Compliance Assessment.

The report can contain:

The assessed subject and revisionThe selected Compliance Baseline or criteriaThe assessment provider and revisionThe assessment timeThe assessment statusThe applicable Compliance FindingsSummary counts or classificationsExceptions or unresolved conditionsReferences to supporting EvidenceProvenance and Traceability informationThe report does not replace the underlying findings, provider results, or Evidence.

Supporting Evidence

Crucible generates and preserves Evidence associated with the Compliance Assessment.

The Evidence can support:

Review of individual Compliance FindingsConfirmation of the subject and criteria assessedReproduction or reevaluation of the assessmentSecurity-control implementation reviewSecurity Controls Traceability Matrix activitiesRisk Management Framework activitiesAuthority to Operate processesAudit and governance activitiesCrucible provides supporting Evidence but does not grant Accreditation, Operational Approval, or an Authority to Operate (ATO).

Connected and Disconnected Assessment

A Compliance Assessment can occur in a Connected Environment, Disconnected Environment, or Air-Gapped Environment when the required criteria, assessment provider, dependencies, and supporting resources are available within the applicable boundary.

Compliance Findings produced during connected operation can accompany the artifacts they describe into a disconnected environment.

Crucible preserves the relationship among:

The assessed artifactThe applicable Compliance BaselineThe assessment providerThe Compliance FindingsThe supporting EvidenceThe applicable Transfer BundleThe source and destination environmentsThe transfer process does not change the meaning or status of a Compliance Finding. A subsequent change to the transferred artifact or its environment can require reassessment.

Assessment Result

The Compliance Assessment result records:

The assessment identifierThe assessed subject and revisionThe selected Compliance Baseline or criteriaThe assessment provider and revisionThe provider-specific parametersThe assessment timeThe provider resultsThe Compliance FindingsThe compliance reportThe supporting EvidenceThe associated ProvenanceThe associated TraceabilityThe transfer relationship, when applicableThe assessment result becomes an input to remediation, image promotion, deployment validation, transfer, authorization-supporting activities, or subsequent reassessment.

Requirements Addressed

Requirement	Statement
FR-COMP-001 — Compliance Baseline Definitions	Crucible SHALL define Compliance Baselines.
FR-COMP-002 — Compliance Scanning Tool Integration	Crucible SHALL integrate with Compliance Scanning Tools.
FR-COMP-003 — Compliance Reporting	Crucible SHALL generate Compliance Reports.
FR-COMP-004 — Compliance Evidence Artifacts	Crucible SHALL generate Compliance Evidence Artifacts.
FR-COMP-005 — DISA STIG Compliance Baselines	Crucible SHALL provide Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Compliance Baselines.
FR-COMP-006 — FedRAMP Baseline Definitions	Crucible SHALL define Federal Risk and Authorization Management Program (FedRAMP) Compliance Baselines.
FR-COMP-007 — Custom Compliance Frameworks	Crucible SHALL define user-defined Compliance Frameworks.
FR-COMP-008a — Compliance Scanning Abstraction	Crucible SHALL provide a Compliance Scanning Abstraction.
FR-COMP-008b — Multiple Operating-System Support	Crucible SHALL evaluate two or more Operating Systems against defined compliance criteria.
FR-COMP-009a — Security Control Traceability Matrix Evidence	Crucible SHALL generate Security-Control Implementation Evidence for inclusion in a Security Control Traceability Matrix (SCTM).
FR-COMP-009b — Risk Management Framework Evidence	Crucible SHALL generate Security-Control Implementation Evidence for use in Risk Management Framework (RMF) activities.
FR-COMP-009c — Authorization to Operate Evidence	Crucible SHALL generate Security-Control Implementation Evidence for use in Authorization to Operate (ATO) activities.
FR-COMP-010a — Compliance Finding Transfer Bundle Inclusion	Crucible SHALL include Compliance Findings in the Transfer Bundle containing the Artifacts to which the Compliance Findings apply.
FR-COMP-010b — Compliance Finding Association Preservation	Crucible SHALL preserve the association between each Compliance Finding and the Artifact to which the Compliance Finding applies when transferring them in a Transfer Bundle from a Connected Environment to a Disconnected Environment.

The linked leaf requirement pages remain the canonical sources.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.