8. Compliance Operations

Go to Crucible

Compliance Operations describe how Crucible applies selected compliance criteria to identified subjects, produces Compliance Findings, generates supporting Evidence, and transfers supported compliance information between operational environments.

The compliance lifecycle includes:

• Selecting the applicable compliance criteria and Compliance Baselines
• Identifying the subject of the assessment
• Selecting and invoking an applicable assessment provider
• Evaluating the subject against the selected criteria
• Producing Compliance Findings
• Generating Compliance Evidence Artifacts
• Producing security-control implementation Evidence
• Including applicable Compliance Findings in a Transfer Bundle
• Preserving required associations between transferred findings and the subjects they describe

Compliance Operations support organizational review, remediation, security-control evaluation, audit, Risk Management Framework activities, and Authority to Operate processes.

Crucible generates and associates compliance information as required by the applicable leaf requirements. Crucible does not independently determine which legal, regulatory, contractual, or organizational criteria apply, and Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.

The child pages distinguish among:

• Selection of compliance criteria
• Execution of a Compliance Assessment
• Production of Compliance Findings
• Generation or preservation of supporting Evidence to the extent required
• Transfer of Compliance Findings and associated information

The applicable leaf requirements in Annex C: Requirements define the required behavior. A child page SHALL NOT claim Evidence retention, repository storage, retrieval, lifecycle-record preservation, or broader traceability unless an approved leaf requirement explicitly establishes that capability.

The title of each child page must remain consistent with the behavior supported by its applicable leaf requirements.

In particular, generation of Compliance Evidence Artifacts does not by itself establish preservation, retention, storage, or retrieval requirements. The scope and title of 8.4 must be reviewed against the approved Evidence-related leaf Statements before that page is finalized.

Requirements remain canonical in Annex C: Requirements and SHALL NOT be duplicated on these pages.