8.3 Produce Compliance Reports [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== 8.3 Produce Compliance Reports ======

[[dido:02-crusible:08-compliance-and-authorization-operations:start|Go to 8. Compliance Operations]]

After completing a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_assessment|Compliance Assessment]], [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] produces a Compliance Report describing the assessment and its results.

The Compliance Report presents the assessment information in a form suitable for review and subsequent compliance activities. Producing the report does not independently establish compliance, approve an exception, accept risk, or authorize operation.

===== Identify the Assessment =====

The Compliance Report identifies the assessment to which it applies.

The report can identify:

  * The assessment identifier
  * The assessment subject
  * The subject revision
  * The selected Compliance Baseline
  * The applicable compliance criteria
  * The assessment provider
  * The provider revision
  * The assessment time
  * The assessment status

The report remains associated with the specific subject and assessment represented by its contents.

===== Present the Assessment Results =====

Crucible presents the results returned by the applicable assessment process.

The report can include:

  * The criteria evaluated
  * The result associated with each evaluated criterion
  * Criteria the provider could not evaluate
  * Incomplete or failed evaluations
  * Assessment errors
  * Summary information derived from the assessment results
  * References to associated Compliance Evidence Artifacts

The Compliance Report does not replace the provider-native results or the supporting Evidence generated under separate requirements.

===== Identify Unsupported and Incomplete Results =====

The report distinguishes a completed assessment from an assessment that could not evaluate all applicable criteria.

The report can identify:

  * Unsupported criteria
  * Unsupported subject types
  * Unsupported operating systems
  * Missing assessment inputs
  * Provider failures
  * Incomplete assessment results
  * Criteria for which no determination was produced

Crucible does not report an unsupported, incomplete, or failed evaluation as a successful result.

===== Relate Results to the Selected Criteria =====

The report maintains the relationship between each reported result and the compliance criterion evaluated.

The report can identify:

  * The criterion identifier
  * The criterion source
  * The applicable Compliance Baseline
  * The Baseline revision
  * The assessment result
  * The assessment provider
  * Any associated explanatory information
  * Any reference to supporting Evidence

This relationship allows a reviewer to determine which criterion produced each reported result.

===== Support Human and Automated Review =====

The Compliance Report can support review by authorized people and systems.

The report format can support:

  * Human-readable presentation
  * Machine-readable processing
  * Comparison of assessment results
  * Review of unsupported or incomplete evaluations
  * Association with Compliance Evidence Artifacts
  * Subsequent compliance and authorization-supporting activities

FR-COMP-003 establishes Compliance Reporting. It does not by itself prescribe a particular report format, schema, visualization, or reporting product.

===== Report Result =====

The reporting result identifies:

  * The Compliance Report
  * The assessment represented by the report
  * The assessed subject
  * The selected Compliance Baseline and criteria
  * The assessment provider
  * The reported assessment results
  * Any unsupported, incomplete, or failed evaluation
  * References to associated Compliance Evidence Artifacts, when available
  * The report-generation status

The Compliance Report becomes an input to authorized review, remediation planning, audit, governance, and authorization-supporting activities.

===== Requirements Addressed =====

^ Requirement ^ Statement ^
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-003:start]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-003:start#Statement&noheader&nofooter&noeditbtn}} |

The linked leaf requirement page remains the canonical source.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>