8.5 Transfer Compliance Findings

Go to 8. Compliance Operations

Crucible includes applicable Compliance Findings in a Transfer Bundle and preserves the association between each transferred finding and the artifact or subject that the finding describes.

Transferring a Compliance Finding makes the recorded result available in the destination environment. Transfer does not change the meaning, status, or applicability of the finding.

Crucible identifies the artifact or subject associated with the Compliance Findings selected for transfer.

The subject remains distinguishable from:

• Other artifacts in the Transfer Bundle
• Other revisions of the same artifact
• Artifacts already present in the destination environment
• Artifacts transferred through another Transfer Bundle
• Artifacts subsequently rebuilt in the destination environment

The identifying information supports preservation of the association between the transferred subject and its Compliance Findings.

Crucible selects the Compliance Findings associated with the subject included in the Transfer Bundle.

Each selected finding remains associated with:

• The assessed subject
• The subject revision, when applicable
• The compliance criterion evaluated
• The recorded assessment result
• The assessment that produced the finding

Crucible does not associate a finding with another subject merely because both subjects appear in the same Transfer Bundle.

Crucible includes the selected Compliance Findings in the Transfer Bundle carrying the associated subject.

The bundle representation identifies:

• The transferred subject
• The applicable Compliance Findings
• The relationship between each finding and the subject
• The Transfer Bundle carrying the subject and findings

The Transfer Bundle can contain findings associated with more than one subject. Crucible preserves each subject-to-finding association independently.

Crucible preserves the association between each Compliance Finding and the subject that the finding describes.

The preserved association allows the destination environment to determine:

• Which subject the finding applies to
• Which revision was assessed, when applicable
• Which findings apply to another subject
• Whether the subject and finding arrived through the same Transfer Bundle

The transfer process does not convert the findings into an unidentified or unassociated collection of assessment results.

Transfer does not:

• Change the result recorded by a Compliance Finding
• Resolve or remediate a finding
• Approve an exception or deviation
• Establish risk acceptance
• Grant Operational Approval
• Grant an Authority to Operate
• Establish that the destination environment satisfies the assessed criterion

The responsible organization determines how transferred Compliance Findings contribute to review, remediation, governance, or authorization activities.

A transferred Compliance Finding remains associated with the subject that was assessed.

If Crucible rebuilds an artifact in the destination environment, the rebuilt artifact constitutes a separate lifecycle result.

Compliance Findings associated with the transferred source artifact do not automatically apply to:

• The rebuilt artifact
• A later artifact revision
• The deployed environment
• Other destination resources
• The complete operational system

The applicable compliance requirements determine whether the rebuilt or deployed subject requires another assessment.

The transfer result identifies:

• The transferred subject
• The subject identifier or revision
• The Compliance Findings included
• The Transfer Bundle carrying the subject and findings
• The preserved subject-to-finding associations
• Any missing or unresolved association
• The transfer-inclusion status

The transferred Compliance Findings become available for destination-side review without changing their recorded meaning or applying them to a different subject.

The linked leaf requirement pages remain the canonical sources.

The approved requirements establish inclusion of Compliance Findings in a Transfer Bundle and preservation of their association with the subjects they describe.

They do not explicitly establish transfer of Compliance Evidence Artifacts. Evidence should be added to the title and content only when an approved leaf requirement requires its inclusion or transfer.