MO-001d — Security Baseline Conformance

Go to MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

Statement

Crucible SHALL create an Infrastructure Environment that conforms to the selected Security Baseline.

Derived From

This requirement derives from:

The Original Requirement states:

Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.[C1]

MO-001d preserves the portion of the Original Requirement that characterizes Infrastructure Environments as secure by requiring each created Infrastructure Environment to conform to the selected Security Baseline.

The separate requirements derived from MO-001 address:

Rationale

The word secure does not establish an objective security obligation unless a controlling Security Baseline identifies the required security controls and conformance criteria.

The selected Security Baseline provides the controlled security requirements against which the created Infrastructure Environment is evaluated.

Security Baseline conformance supports:

Consistent application of required security controlsObjective evaluation of the created Infrastructure EnvironmentIdentification of unmet or incorrectly implemented controlsEvidence generationProvenanceTraceabilityIndependent review of security outcomesSeparating Security Baseline conformance from Infrastructure Environment creation permits Crucible to create an Infrastructure Environment while independently passing or failing the security requirement.

This requirement does not establish a deployment-duration threshold, reproducibility criterion, or Compliance Baseline. The other requirements derived from MO-001 address those outcomes.

Applies To

This requirement applies to:

Security controlsSecurity-control implementationSecurity-control evaluationSecurity findingsControlled InputsBaselinesInfrastructure BaselinesInfrastructure ConfigurationsMachine ImagesImage LayersEvidenceProvenanceTraceabilityConnected EnvironmentsDisconnected EnvironmentsAir-Gapped Environments

Verification

Verification confirms that:

The selected Security Baseline is identifiedThe Security Baseline identifies the security controls and conformance criteria used for evaluationThe created Infrastructure Environment is evaluated against the selected Security BaselineEach required security control is evaluatedThe created Infrastructure Environment satisfies the conformance criteria defined by the selected Security BaselineAny security finding is identified and associated with the affected security controlThe verification record preserves Traceability among the selected Security Baseline, the evaluated security controls, the created Infrastructure Environment, and the evaluation result

Referenced By

The following pages reference this requirement:

Delivery Phase

Implemented and Verified

Implementation Status

Requirement Status

Issues

The following unresolved issues affect this requirement:

Notes for Editors

This requirement page should retain the stable requirement identifier MO-001d.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The parent MO-001 page is a non-leaf page and retains a trailing :start in its namespace.

Changes to the Statement should preserve:

as the responsible actorCreation of an Infrastructure Environment as the required outcomeThe selected Security Baseline as the controlling security sourceConformance to the selected Security Baseline as the required security outcomeThe unresolved Security Baseline selection and conformance criteria should remain recorded in the Issues section until a controlling source resolves them.

Material changes should receive review and should update the verification criteria, source records, and Issues section.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.