8. Compliance Operations

Go to Crucible

Compliance Operations describe how Crucible applies selected compliance criteria to identified subjects, produces Compliance Findings, generates supporting Evidence, and transfers supported compliance information between operational environments.

The compliance lifecycle includes:

Selecting the applicable compliance criteria and Compliance BaselinesIdentifying the subject of the assessmentSelecting and invoking an applicable assessment providerEvaluating the subject against the selected criteriaProducing Compliance FindingsGenerating Compliance Evidence ArtifactsProducing security-control implementation EvidenceIncluding applicable Compliance Findings in a Transfer BundlePreserving required associations between transferred findings and the subjects they describeCompliance Operations support organizational review, remediation, security-control evaluation, audit, Risk Management Framework activities, and Authority to Operate processes.

Crucible generates and associates compliance information as required by the applicable leaf requirements. Crucible does not independently determine which legal, regulatory, contractual, or organizational criteria apply, and Crucible does not grant Accreditation, Operational Approval, risk acceptance, or an Authority to Operate.

The child pages distinguish among:

Selection of compliance criteriaExecution of a Compliance AssessmentProduction of Compliance FindingsGeneration or preservation of supporting Evidence to the extent requiredTransfer of Compliance Findings and associated informationThe applicable leaf requirements in Annex C: Requirements define the required behavior. A child page SHALL NOT claim Evidence retention, repository storage, retrieval, lifecycle-record preservation, or broader traceability unless an approved leaf requirement explicitly establishes that capability.

Contents

Notes for Editors

The title of each child page must remain consistent with the behavior supported by its applicable leaf requirements.

In particular, generation of Compliance Evidence Artifacts does not by itself establish preservation, retention, storage, or retrieval requirements. The scope and title of 8.4 must be reviewed against the approved Evidence-related leaf Statements before that page is finalized.

Requirements remain canonical in Annex C: Requirements and SHALL NOT be duplicated on these pages.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.