| Next revision | Previous revision |
| dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d [2026/07/20 07:57] – created nick_dido | dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d [2026/07/30 05:20] (current) – [Delivery Phase] nick_dido |
|---|
| ===== Statement ===== | ===== Statement ===== |
| |
| [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL create an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] in [[dido:99_annexes:annex-b-terms-and-definitions:c:conformance|conformance]] with the selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]]. | [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL create an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] that conforms to the selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]]. |
| |
| ===== Derived From ===== | ===== Derived From ===== |
| > //Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] | > //Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] |
| |
| MO-001d preserves the portion of the Original Requirement that characterizes an Infrastructure Environment as **secure**. | MO-001d preserves the portion of the Original Requirement that characterizes Infrastructure Environments as **secure** by requiring each created Infrastructure Environment to conform to the selected Security Baseline. |
| |
| The separate requirements derived from MO-001 address: | The separate requirements derived from MO-001 address: |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c|MO-001c — Reproducibility]] | * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c|MO-001c — Reproducibility]] |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e|MO-001e — Compliance Baseline Conformance]] | * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e|MO-001e — Compliance Baseline Conformance]] |
| |
| ===== Assessment ===== | |
| |
| The Original Requirement uses **secure** without identifying: | |
| |
| * The applicable security requirements | |
| * The controlling Security Baseline | |
| * The security controls applicable to the Infrastructure Environment | |
| * The criteria used to determine satisfaction of those controls | |
| * The Evidence required to support the determination | |
| * The treatment of security findings or exceptions | |
| |
| The term **secure** describes a desired quality but does not establish an objectively verifiable condition. | |
| |
| MO-001d: | |
| |
| * Replaces **secure** with conformance to an identified Security Baseline | |
| * Identifies [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor | |
| * Identifies the created [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] as the subject of conformance | |
| * Identifies the selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] as the controlling source of security requirements | |
| * Separates security conformance from Infrastructure Environment creation, deployment duration, reproducibility, and compliance outcomes | |
| |
| ===== Rationale ===== | ===== Rationale ===== |
| |
| A general claim that an Infrastructure Environment is secure does not identify the security requirements that the environment satisfies. | The word **secure** does not establish an objective security obligation unless a controlling Security Baseline identifies the required security controls and conformance criteria. |
| |
| A selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] establishes the applicable security requirements, security controls, configuration settings, assessment criteria, and required [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] for a defined operational context. | The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] provides the controlled security requirements against which the created Infrastructure Environment is evaluated. |
| |
| Security Baselines can address: | Security Baseline conformance supports: |
| |
| * Operating-system hardening | * Consistent application of required security controls |
| * Identity and access control | * Objective evaluation of the created Infrastructure Environment |
| * Authentication | * Identification of unmet or incorrectly implemented controls |
| * Authorization | * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] generation |
| * Privilege management | * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] |
| * Account configuration | * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] |
| * Network configuration | * Independent review of security outcomes |
| * Service configuration | |
| * Cryptographic configuration | |
| * Audit configuration | |
| * Logging | |
| * File and directory permissions | |
| * Software and package restrictions | |
| * Vulnerability remediation | |
| * Security monitoring | |
| * Data protection | |
| * System integrity | |
| |
| The selected Security Baseline provides the reference against which the Infrastructure Environment is evaluated. | Separating Security Baseline conformance from Infrastructure Environment creation permits Crucible to create an Infrastructure Environment while independently passing or failing the security requirement. |
| |
| Conformance requires satisfaction of the applicable requirements established by the selected Security Baseline. The existence of a Security Baseline, application of a hardening process, or execution of a security assessment does not alone establish conformance. | This requirement does not establish a deployment-duration threshold, reproducibility criterion, or [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. The other requirements derived from MO-001 address those outcomes. |
| | |
| Separating Security Baseline conformance from MO-001a permits Crucible to create an Infrastructure Environment successfully while independently passing or failing the applicable security requirements. | |
| | |
| This requirement does not establish the applicable Compliance Baseline. MO-001e addresses Compliance Baseline conformance. | |
| |
| ===== Applies To ===== | ===== Applies To ===== |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:conformance|Conformance]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environments]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environments]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baselines]] |
| * Security requirements | |
| * Security controls | * Security controls |
| * Security configurations | * Security-control implementation |
| * Security assessments | * Security-control evaluation |
| * Security findings | * Security findings |
| * Security exceptions | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:controlled_input|Controlled Inputs]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:controlled_input|Controlled Inputs]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:d:declarative_description|Declarative Descriptions]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible_description|Crucible Descriptions]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baselines]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline_composition|Baseline Composition]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_configuration|Infrastructure Configurations]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] | * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_configuration|Infrastructure Configurations]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_deployment|Infrastructure Deployments]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_plane|Security Plane]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] | * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] | * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] | * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environments]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environments]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:a:air-gapped_environment|Air-Gapped Environments]] |
| |
| ===== Verification ===== | ===== Verification ===== |
| Verification confirms that: | Verification confirms that: |
| |
| - The selected Security Baseline is uniquely identified | - The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] is identified |
| - The selected Security Baseline identifies the security requirements applicable to the Infrastructure Environment | - The Security Baseline identifies the security controls and conformance criteria used for evaluation |
| - The Infrastructure Environment is evaluated against each applicable security requirement | - The created [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] is evaluated against the selected Security Baseline |
| - Each applicable security requirement has a recorded result | - Each required security control is evaluated |
| - The Infrastructure Environment satisfies the conformance criteria established by the selected Security Baseline | - The created Infrastructure Environment satisfies the conformance criteria defined by the selected Security Baseline |
| - Each identified security finding, exception, or deviation is recorded | - Any security finding is identified and associated with the affected security control |
| - The generated Evidence supports the conformance determination | - The verification record preserves [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] among the selected Security Baseline, the evaluated security controls, the created Infrastructure Environment, and the evaluation result |
| | |
| Verification includes: | |
| | |
| * Security Baseline inspection | |
| * Security requirement inspection | |
| * Security control inspection | |
| * Security configuration inspection | |
| * Security assessment | |
| * Automated security testing | |
| * Manual security testing | |
| * Infrastructure state inspection | |
| * Machine Image inspection | |
| * Package and software inventory inspection | |
| * Vulnerability assessment | |
| * Audit configuration inspection | |
| * Logging configuration inspection | |
| * Access-control inspection | |
| * Security finding inspection | |
| * Security exception inspection | |
| * Evidence inspection | |
| * Provenance inspection | |
| * Traceability inspection | |
| | |
| The verification record identifies: | |
| | |
| - The selected Security Baseline | |
| - The Security Baseline identifier and revision | |
| - The Infrastructure Environment under evaluation | |
| - The applicable security requirements | |
| - The security controls associated with each requirement | |
| - The evaluation method applied to each requirement | |
| - The result for each applicable security requirement | |
| - Each identified security finding | |
| - Each approved security exception or deviation | |
| - The overall conformance result | |
| - The generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] | |
| - The applicable [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] | |
| - The applicable [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] | |
| | |
| ===== Requirements Realized By ===== | |
| | |
| This requirement is realized by: | |
| | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-002|OR-002 — Deployment Environments]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003|OR-003 — Classified and Unclassified Environments]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-01-configuration-management:start|FR-CFG-001 through FR-CFG-005]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:start|FR-IMG-001 through FR-IMG-006]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-03-deployment-orchestration:start|FR-DEP-001 through FR-DEP-007]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:start|FR-AG-001 through FR-AG-005]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|FR-COMP-001 through FR-COMP-010]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-08-devsecops-integration:start|FR-DSO-001 through FR-DSO-006]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-09-baseline-composition-and-workspace:start|FR-BAS-001 through FR-BAS-004]] | |
| | |
| ===== Related Architecture Sections ===== | |
| | |
| * [[dido:02-crusible:05-descriptions-composition-and-baselines:start|5. Descriptions, Composition, and Baselines]] | |
| * [[dido:02-crusible:06-machine-images-and-image-layers:start|6. Machine Images and Image Layers]] | |
| * [[dido:02-crusible:07-infrastructure-and-deployment:start|7. Infrastructure and Deployment]] | |
| * [[dido:02-crusible:08-dependencies-and-air-gap-operations:start|8. Dependencies and Air Gap Operations]] | |
| * [[dido:02-crusible:09-compliance-and-security:start|9. Compliance and Security]] | |
| * [[dido:02-crusible:10-reproducibility-provenance-and-traceability:start|10. Reproducibility, Provenance, and Traceability]] | |
| |
| ===== Referenced By ===== | ===== Referenced By ===== |
| ===== Delivery Phase ===== | ===== Delivery Phase ===== |
| |
| Phase 1 and subsequent phases | Implemented and Verified |
| |
| ===== Implementation Status ===== | ===== Implementation Status ===== |
| |
| Not Assessed | <todo>Assess whether the current Crucible implementation creates Infrastructure Environments that conform to the selected Security Baseline.</todo> |
| | |
| Implementation status requires evaluation of an Infrastructure Environment created by the current Crucible implementation against the selected Security Baseline. | |
| |
| ===== Requirement Status ===== | ===== Requirement Status ===== |
| |
| Draft | <todo>Review and accept MO-001d as a proposed derived requirement created from the evaluation and decomposition of MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft.</todo> |
| |
| This requirement derives from MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft. | ---- |
| | ===== Issues ===== |
| | |
| | The following unresolved issues affect this requirement: |
| | |
| | <todo>Identify the controlling source that selects the Security Baseline for each Infrastructure Environment.</todo> |
| | |
| | <todo>Identify the security controls and conformance criteria that determine Security Baseline conformance.</todo> |
| | |
| | <todo>Define how exceptions, deviations, waivers, and compensating controls affect Security Baseline conformance.</todo> |
| | |
| | <todo>Define whether an Infrastructure Environment with unresolved security findings can satisfy this requirement.</todo> |
| |
| ---- | ---- |
| This page is a leaf requirement page and omits a trailing '':start'' from its namespace. | This page is a leaf requirement page and omits a trailing '':start'' from its namespace. |
| |
| Changes to the Statement SHALL preserve the security intent derived from MO-001. | The parent MO-001 page is a non-leaf page and retains a trailing '':start'' in its namespace. |
| | |
| | Changes to the Statement should preserve: |
| |
| The selected Security Baseline should identify: | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor |
| | * Creation of an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] as the required outcome |
| | * The selected [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]] as the controlling security source |
| | * Conformance to the selected Security Baseline as the required security outcome |
| |
| * The Security Baseline identifier | The unresolved Security Baseline selection and conformance criteria should remain recorded in the Issues section until a controlling source resolves them. |
| * The Security Baseline revision | |
| * The applicable operational context | |
| * The applicable security requirements | |
| * The associated security controls | |
| * The evaluation criteria | |
| * The permitted exceptions or deviations | |
| * The required Evidence | |
| * The conformance determination criteria | |
| |
| Material changes should receive review and should update the related verification criteria, requirements realization, related architecture sections, and source records. | Material changes should receive review and should update the verification criteria, source records, and Issues section. |
| |
| To reference this requirement Statement from another wiki page, insert: | To reference this requirement Statement from another wiki page, insert: |