6.1 Construct and Assess the Environment

Go to 6. Connected Operations

Within a Connected Environment, Crucible constructs controlled Images and assesses identified subjects against applicable compliance criteria.

Connectivity provides access to the authorized resources required by the applicable construction and assessment activities. The Image Management and Compliance Management requirements define the capabilities performed. Connected operation does not establish a separate source-access capability.

Crucible uses the applicable controlled inputs for the selected construction or assessment activity.

Construction inputs can include:

• A selected Baseline Composition
• A base Machine Image or Container Image
• Selected Image Layers
• Application content
• Software packages
• Configuration definitions
• Security configuration
• Build dependencies
• Applicable build parameters

Assessment inputs can include:

• The identified assessment subject
• The applicable Compliance Baseline
• Compliance criteria
• Assessment content
• The selected assessment provider
• Provider-specific parameters

The applicable lifecycle definition identifies the inputs required for each activity.

Crucible constructs an identified Machine Image or Container Image from the selected controlled inputs.

The construction activity can include:

1. Select the applicable image form
2. Select the controlled build inputs
3. Execute the applicable construction process
4. Produce the resulting Image
5. Assign the Image identifier and revision
6. Record the Image content digest
7. Sign the Image when required
8. Verify the Image signature when required
9. Apply the applicable promotion transition

When a required change affects a deployed immutable Image, Crucible constructs a replacement Image rather than modifying the deployed Image in place.

Image construction does not independently establish compliance or authorization for deployment.

Crucible identifies the compliance criteria applicable to the assessment subject.

The criteria can derive from:

• A Compliance Baseline
• A DISA STIG Compliance Baseline
• A FedRAMP Baseline
• A custom compliance framework
• Another approved set of compliance criteria

The responsible organization determines which compliance criteria apply to the assessment subject.

Crucible integrates with an applicable compliance-scanning or assessment tool and evaluates the identified subject against the selected compliance criteria.

The assessment activity can include:

1. Identify the assessment subject
2. Select the applicable Compliance Baseline or criteria
3. Select the assessment provider
4. Supply the required assessment parameters
5. Execute the assessment
6. Receive the assessment results
7. Produce the applicable Compliance Findings
8. Generate the compliance report
9. Generate the Compliance Evidence Artifacts

The compliance-scanning abstraction separates the assessment activity from a particular operating system or scanning product.

Support for multiple operating systems does not require every assessment provider to support every operating system.

The assessment result identifies the relationship between the assessed subject and the applicable compliance criteria.

The result can include:

• The assessed subject and revision
• The selected Compliance Baseline or criteria
• The assessment provider
• The assessment results
• Compliance Findings
• The compliance report
• Compliance Evidence Artifacts
• Security-control implementation Evidence
• Transferable Compliance Findings, when applicable

Crucible generates Evidence that can support Security Control Traceability Matrix, Risk Management Framework, and Authority to Operate activities.

Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.

The connected construction and assessment activities produce identifiable results that can include:

• A constructed Machine Image or Container Image
• An Image identifier and revision
• An Image content digest
• A Digital Signature
• A signature-verification result
• An Image promotion result
• Compliance Findings
• A compliance report
• Compliance Evidence Artifacts
• Security-control implementation Evidence
• Transferable Compliance Findings

The applicable lifecycle activity determines which results Crucible produces.

The linked leaf requirement pages remain the canonical sources.