7.7 Preserve Traceability Across Environments

Go to 7. Disconnected and Air-Gapped Operations

When Compliance Findings accompany an artifact between environments, Crucible preserves the association between each finding and the artifact or subject that the finding describes.

The preserved association allows the destination environment to determine which transferred artifact was assessed and which Compliance Findings resulted from that assessment.

This page addresses preservation of the association required by FR-COMP-010b. It does not establish a general records-retention, provenance-preservation, or lifecycle-traceability capability beyond the approved requirement.

Crucible identifies the artifact or subject included in the Transfer Bundle.

The transferred subject remains distinguishable from:

• Other artifacts in the Transfer Bundle
• Other revisions of the same artifact
• Artifacts transferred through another Transfer Bundle
• Artifacts already present in the destination environment

The identifying information must be sufficient to maintain the association between the subject and its transferred Compliance Findings.

Crucible identifies the Compliance Findings associated with the transferred subject.

Each association identifies:

• The transferred subject
• The associated Compliance Finding
• The assessment result represented by the finding
• The relationship between the finding and the assessed subject

A Transfer Bundle can contain findings associated with more than one subject. Crucible preserves each subject-to-finding association independently.

Crucible includes the information required to preserve the association within the Transfer Bundle.

The transfer process must not convert the associated findings into an unidentified collection of results.

The preserved association allows the destination environment to determine:

• Which findings apply to the transferred subject
• Which findings apply to another subject
• Whether a finding remains associated with the expected artifact
• Whether the transferred subject and associated findings were carried by the same Transfer Bundle

During import, Crucible maintains the association represented in the Transfer Bundle.

Import does not:

• Reassign a Compliance Finding to another artifact
• Remove the association between a finding and its subject
• Treat an unassociated finding as evidence about the imported artifact
• Change the result recorded by the Compliance Finding

The imported association remains available to the destination-side lifecycle activities that use the transferred subject or review its Compliance Findings.

A rebuilt artifact is a new lifecycle result, even when Crucible constructs it from the same transferred inputs.

Compliance Findings associated with the transferred source artifact do not automatically become findings for the rebuilt artifact.

The applicable compliance requirements determine whether Crucible must assess the rebuilt artifact and generate new Compliance Findings.

Crucible must preserve the distinction between:

• The transferred artifact and its associated findings
• The rebuilt artifact
• Any subsequent assessment of the rebuilt artifact
• Any findings generated by that subsequent assessment

Deployment of a transferred or rebuilt artifact does not change the recorded association between the original assessed subject and its Compliance Findings.

Compliance Findings associated with an artifact do not automatically represent the compliance state of:

• The destination environment
• The deployed configuration
• Other deployed resources
• A later revision of the artifact
• The complete operational system

Separate assessment requirements govern those subjects.

The preserved association identifies:

• The transferred subject
• The subject identifier or revision
• The associated Compliance Findings
• The Transfer Bundle carrying the subject and findings
• The imported subject
• The destination environment
• The maintained subject-to-finding relationships
• Any missing, unresolved, or invalid association

The preserved association supports review of the transferred Compliance Findings without changing their meaning or applying them to a different subject.

The linked leaf requirement page remains the canonical source.

The title uses “Traceability” in the limited sense of preserving the association between transferred Compliance Findings and their assessed subjects.

A broader page covering general provenance, lifecycle records, cross-environment lineage, retention, or auditability requires additional approved leaf requirements.