5.7 Preserve Evidence and Lifecycle Records

Go to 5. Operational Concept

Crucible preserves Evidence and lifecycle records produced during baseline composition, image construction, dependency capture, compliance assessment, deployment, and validation.

Preservation maintains the relationship among:

The activity performedThe subject of the activityThe controlled inputsThe applicable criteriaThe actor or system performing the activityThe resulting outputThe observed statusThe generated EvidenceThe associated ProvenanceThe associated TraceabilityA preserved record documents what occurred during a Crucible lifecycle activity. The record does not independently establish approval, authorization, certification, risk acceptance, or operational suitability.

Evidence Generation

Crucible generates Evidence when an applicable lifecycle activity produces information needed to support evaluation, review, reproduction, audit, or authorization-related processes.

Evidence can include:

Baseline and composition recordsImage-build recordsImage identifiers and content digestsDigital signatures and signature-verification resultsDependency ManifestsDependency RecordsDependency integrity resultsCompliance FindingsCompliance reportsAssessment-provider resultsDeployment-operation resultsDeployment Validation resultsTransfer recordsImport and export verification resultsError, exception, and incomplete-operation recordsThe applicable requirement determines which Evidence Crucible produces for a particular activity.

Evidence Identification

Each Evidence artifact remains identifiable and associated with the lifecycle activity that produced it.

An Evidence record can identify:

The Evidence identifierThe Evidence typeThe subject described by the EvidenceThe producing lifecycle activityThe producing actor, component, or External SystemThe activity timeThe applicable Baseline, criterion, or policyThe Evidence contentThe Evidence formatThe integrity valueThe preservation locationRelated Evidence and lifecycle recordsAn Evidence artifact does not become authoritative merely because Crucible preserves it. The applicable governance process determines how an organization evaluates and uses the Evidence.

Lifecycle Records

A lifecycle record documents an identified Crucible activity and its result.

Lifecycle records can describe:

Selection and composition of BaselinesConstruction, signing, verification, and promotion of ImagesIdentification, capture, verification, and preservation of DependenciesCompliance Assessments and Compliance FindingsDeployment OperationsDeployment failures and rollback activitiesDeployment ValidationExport, transfer, and import operationsChanges in lifecycle stateErrors, exceptions, and unresolved conditionsCrucible preserves sufficient information to relate a lifecycle record to the subject, inputs, operation, result, and supporting Evidence.

Provenance

Provenance identifies the origin and history of an artifact, record, or lifecycle result.

Crucible preserves Provenance information needed to determine:

Where an input originatedWhich revision Crucible usedWhich activity consumed the inputWhich actor or system performed the activityWhich output the activity producedWhich prior artifact or state preceded the outputWhich Evidence supports the recorded resultProvenance enables a reviewer to follow the history of a lifecycle result without treating undocumented assumptions as part of the record.

Traceability

Traceability preserves navigable relationships among lifecycle inputs, activities, outputs, requirements, findings, and Evidence.

Traceability can relate:

A requirement to its implementing BaselineA Baseline to a compositionA composition to a constructed ImageAn Image to its build inputsAn artifact to its DependenciesA subject to its Compliance FindingsA deployment to its Deployment TargetA Deployment Validation result to its Acceptance CriteriaEvidence to the activity that generated itA transferred artifact to its source and destination environmentsTraceability does not require all lifecycle information to reside in one physical repository. The preserved relationships must allow the associated records to remain identifiable and retrievable.

Integrity Protection

Crucible preserves integrity information for Evidence and lifecycle records when the applicable requirement requires integrity verification.

Integrity protection can include:

Content digestsDigital signaturesImmutable or append-only storageVersion-controlled recordsRecorded prior revisionsControlled repository accessVerification resultsAn integrity result determines whether the evaluated content corresponds to its recorded integrity value. It does not independently establish the correctness or sufficiency of the content.

Preservation and Retrieval

Crucible preserves Evidence and lifecycle records in an authorized repository or record store.

Preservation maintains:

Record identityRecord contentAssociated metadataProvenanceTraceability relationshipsIntegrity informationPreservation locationApplicable retention informationRetrieval statusAuthorized actors and systems can retrieve preserved Evidence and lifecycle records through the applicable Crucible interface and access controls.

The governing organization defines retention periods, legal holds, disposal rules, classification restrictions, and other records-management obligations.

Transfer Between Environments

Evidence and lifecycle records can accompany an artifact or operational result when Crucible transfers the subject between environments.

The applicable Transfer Bundle can include:

The transferred artifactApplicable Compliance FindingsSupporting EvidenceDependency informationIntegrity informationProvenance informationTraceability relationshipsExport and import recordsCrucible preserves the association between a transferred subject and its related Compliance Findings and Evidence.

Transfer does not change the recorded meaning, result, or status of the Evidence. A change to the transferred subject or destination environment can require additional assessment or validation.

Authorization-Supporting Evidence

Crucible can preserve Evidence used to support:

Security Control Traceability Matrix activitiesRisk Management Framework activitiesAuthority to Operate processesCompliance reviewsSecurity assessmentsAudit activitiesGovernance decisionsCrucible provides and preserves the supporting Evidence. Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.

Preservation Result

The preservation result records:

The Evidence and lifecycle records preservedThe subjects and activities associated with each recordThe Provenance informationThe Traceability relationshipsThe integrity informationThe preservation locationsThe preservation statusAny missing or unresolved recordAny transfer relationshipThe retrieval statusThe preserved Evidence and lifecycle records remain available for subsequent review, assessment, validation, transfer, reproduction, audit, governance, or authorization-supporting activities.

Requirements Addressed

Requirement	Statement
FR-COMP-009a — Security Control Traceability Matrix Evidence	Crucible SHALL generate Security-Control Implementation Evidence for inclusion in a Security Control Traceability Matrix (SCTM).
FR-COMP-009b — Risk Management Framework Evidence	Crucible SHALL generate Security-Control Implementation Evidence for use in Risk Management Framework (RMF) activities.
FR-COMP-009c — Authorization to Operate Evidence	Crucible SHALL generate Security-Control Implementation Evidence for use in Authorization to Operate (ATO) activities.
FR-COMP-010a — Compliance Finding Transfer Bundle Inclusion	Crucible SHALL include Compliance Findings in the Transfer Bundle containing the Artifacts to which the Compliance Findings apply.
FR-COMP-010b — Compliance Finding Association Preservation	Crucible SHALL preserve the association between each Compliance Finding and the Artifact to which the Compliance Finding applies when transferring them in a Transfer Bundle from a Connected Environment to a Disconnected Environment.

The linked leaf requirement pages remain the canonical sources.

The confirmed requirements above directly support Compliance Evidence and preservation of transferred Compliance Finding associations. Any separate Evidence Management, provenance, traceability, audit-record, or lifecycle-record leaf requirements should also be added when their exact identifiers and namespaces are confirmed.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.