5.7 Preserve Evidence and Lifecycle Records [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== 5.7 Preserve Evidence and Lifecycle Records ======

[[dido:02-crusible:05-operational-concept:start|Go to 5. Operational Concept]]

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] preserves [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] and lifecycle records produced during baseline composition, image construction, dependency capture, compliance assessment, deployment, and validation.

Preservation maintains the relationship among:

  * The activity performed
  * The subject of the activity
  * The controlled inputs
  * The applicable criteria
  * The actor or system performing the activity
  * The resulting output
  * The observed status
  * The generated Evidence
  * The associated [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]]
  * The associated [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]]

A preserved record documents what occurred during a Crucible lifecycle activity. The record does not independently establish approval, authorization, certification, risk acceptance, or operational suitability.

===== Evidence Generation =====

Crucible generates Evidence when an applicable lifecycle activity produces information needed to support evaluation, review, reproduction, audit, or authorization-related processes.

Evidence can include:

  * Baseline and composition records
  * Image-build records
  * Image identifiers and content digests
  * Digital signatures and signature-verification results
  * Dependency Manifests
  * Dependency Records
  * Dependency integrity results
  * Compliance Findings
  * Compliance reports
  * Assessment-provider results
  * Deployment-operation results
  * Deployment Validation results
  * Transfer records
  * Import and export verification results
  * Error, exception, and incomplete-operation records

The applicable requirement determines which Evidence Crucible produces for a particular activity.

===== Evidence Identification =====

Each Evidence artifact remains identifiable and associated with the lifecycle activity that produced it.

An Evidence record can identify:

  * The Evidence identifier
  * The Evidence type
  * The subject described by the Evidence
  * The producing lifecycle activity
  * The producing actor, component, or External System
  * The activity time
  * The applicable Baseline, criterion, or policy
  * The Evidence content
  * The Evidence format
  * The integrity value
  * The preservation location
  * Related Evidence and lifecycle records

An Evidence artifact does not become authoritative merely because Crucible preserves it. The applicable governance process determines how an organization evaluates and uses the Evidence.

===== Lifecycle Records =====

A lifecycle record documents an identified Crucible activity and its result.

Lifecycle records can describe:

  * Selection and composition of Baselines
  * Construction, signing, verification, and promotion of Images
  * Identification, capture, verification, and preservation of Dependencies
  * Compliance Assessments and Compliance Findings
  * Deployment Operations
  * Deployment failures and rollback activities
  * Deployment Validation
  * Export, transfer, and import operations
  * Changes in lifecycle state
  * Errors, exceptions, and unresolved conditions

Crucible preserves sufficient information to relate a lifecycle record to the subject, inputs, operation, result, and supporting Evidence.

===== Provenance =====

Provenance identifies the origin and history of an artifact, record, or lifecycle result.

Crucible preserves Provenance information needed to determine:

  * Where an input originated
  * Which revision Crucible used
  * Which activity consumed the input
  * Which actor or system performed the activity
  * Which output the activity produced
  * Which prior artifact or state preceded the output
  * Which Evidence supports the recorded result

Provenance enables a reviewer to follow the history of a lifecycle result without treating undocumented assumptions as part of the record.

===== Traceability =====

Traceability preserves navigable relationships among lifecycle inputs, activities, outputs, requirements, findings, and Evidence.

Traceability can relate:

  * A requirement to its implementing Baseline
  * A Baseline to a composition
  * A composition to a constructed Image
  * An Image to its build inputs
  * An artifact to its Dependencies
  * A subject to its Compliance Findings
  * A deployment to its Deployment Target
  * A Deployment Validation result to its Acceptance Criteria
  * Evidence to the activity that generated it
  * A transferred artifact to its source and destination environments

Traceability does not require all lifecycle information to reside in one physical repository. The preserved relationships must allow the associated records to remain identifiable and retrievable.

===== Integrity Protection =====

Crucible preserves integrity information for Evidence and lifecycle records when the applicable requirement requires integrity verification.

Integrity protection can include:

  * Content digests
  * Digital signatures
  * Immutable or append-only storage
  * Version-controlled records
  * Recorded prior revisions
  * Controlled repository access
  * Verification results

An integrity result determines whether the evaluated content corresponds to its recorded integrity value. It does not independently establish the correctness or sufficiency of the content.

===== Preservation and Retrieval =====

Crucible preserves Evidence and lifecycle records in an authorized repository or record store.

Preservation maintains:

  * Record identity
  * Record content
  * Associated metadata
  * Provenance
  * Traceability relationships
  * Integrity information
  * Preservation location
  * Applicable retention information
  * Retrieval status

Authorized actors and systems can retrieve preserved Evidence and lifecycle records through the applicable Crucible interface and access controls.

The governing organization defines retention periods, legal holds, disposal rules, classification restrictions, and other records-management obligations.

===== Transfer Between Environments =====

Evidence and lifecycle records can accompany an artifact or operational result when Crucible transfers the subject between environments.

The applicable [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] can include:

  * The transferred artifact
  * Applicable Compliance Findings
  * Supporting Evidence
  * Dependency information
  * Integrity information
  * Provenance information
  * Traceability relationships
  * Export and import records

Crucible preserves the association between a transferred subject and its related Compliance Findings and Evidence.

Transfer does not change the recorded meaning, result, or status of the Evidence. A change to the transferred subject or destination environment can require additional assessment or validation.

===== Authorization-Supporting Evidence =====

Crucible can preserve Evidence used to support:

  * Security Control Traceability Matrix activities
  * Risk Management Framework activities
  * Authority to Operate processes
  * Compliance reviews
  * Security assessments
  * Audit activities
  * Governance decisions

Crucible provides and preserves the supporting Evidence. Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.

===== Preservation Result =====

The preservation result records:

  * The Evidence and lifecycle records preserved
  * The subjects and activities associated with each record
  * The Provenance information
  * The Traceability relationships
  * The integrity information
  * The preservation locations
  * The preservation status
  * Any missing or unresolved record
  * Any transfer relationship
  * The retrieval status

The preserved Evidence and lifecycle records remain available for subsequent review, assessment, validation, transfer, reproduction, audit, governance, or authorization-supporting activities.

===== Requirements Addressed =====

^ Requirement ^ Statement ^
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009a]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009a#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009c]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009c#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010a]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010a#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b#Statement&noheader&nofooter&noeditbtn}} |

The linked leaf requirement pages remain the canonical sources.

The confirmed requirements above directly support Compliance Evidence and preservation of transferred Compliance Finding associations. Any separate Evidence Management, provenance, traceability, audit-record, or lifecycle-record leaf requirements should also be added when their exact identifiers and namespaces are confirmed.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>