MO-001d — Security Baseline Conformance

Go to MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

Statement

Crucible SHALL create an Infrastructure Environment in conformance with the selected Security Baseline.

Derived From

This requirement derives from:

The Original Requirement states:

Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.[C1]

MO-001d preserves the portion of the Original Requirement that characterizes an Infrastructure Environment as secure.

The separate requirements derived from MO-001 address:

Assessment

The Original Requirement uses secure without identifying:

The applicable security requirementsThe controlling Security BaselineThe security controls applicable to the Infrastructure EnvironmentThe criteria used to determine satisfaction of those controlsThe Evidence required to support the determinationThe treatment of security findings or exceptionsThe term secure describes a desired quality but does not establish an objectively verifiable condition.

MO-001d:

Replaces secure with conformance to an identified Security BaselineIdentifies Crucible as the responsible actorIdentifies the created Infrastructure Environment as the subject of conformanceIdentifies the selected Security Baseline as the controlling source of security requirementsSeparates security conformance from Infrastructure Environment creation, deployment duration, reproducibility, and compliance outcomes

Rationale

A general claim that an Infrastructure Environment is secure does not identify the security requirements that the environment satisfies.

A selected Security Baseline establishes the applicable security requirements, security controls, configuration settings, assessment criteria, and required Evidence for a defined operational context.

Security Baselines can address:

Operating-system hardeningIdentity and access controlAuthenticationAuthorizationPrivilege managementAccount configurationNetwork configurationService configurationCryptographic configurationAudit configurationLoggingFile and directory permissionsSoftware and package restrictionsVulnerability remediationSecurity monitoringData protectionSystem integrityThe selected Security Baseline provides the reference against which the Infrastructure Environment is evaluated.

Conformance requires satisfaction of the applicable requirements established by the selected Security Baseline. The existence of a Security Baseline, application of a hardening process, or execution of a security assessment does not alone establish conformance.

Separating Security Baseline conformance from MO-001a permits Crucible to create an Infrastructure Environment successfully while independently passing or failing the applicable security requirements.

This requirement does not establish the applicable Compliance Baseline. MO-001e addresses Compliance Baseline conformance.

Applies To

This requirement applies to:

Security requirementsSecurity controlsSecurity configurationsSecurity assessmentsSecurity findingsSecurity exceptionsControlled InputsDeclarative DescriptionsCrucible DescriptionsBaselinesBaseline CompositionImage LayersInfrastructure BaselinesMachine ImagesInfrastructure ConfigurationsInfrastructure DeploymentsSecurity PlaneEvidenceProvenanceTraceability

Verification

Verification confirms that:

The selected Security Baseline is uniquely identifiedThe selected Security Baseline identifies the security requirements applicable to the Infrastructure EnvironmentThe Infrastructure Environment is evaluated against each applicable security requirementEach applicable security requirement has a recorded resultThe Infrastructure Environment satisfies the conformance criteria established by the selected Security BaselineEach identified security finding, exception, or deviation is recordedThe generated Evidence supports the conformance determinationVerification includes:

Security Baseline inspectionSecurity requirement inspectionSecurity control inspectionSecurity configuration inspectionSecurity assessmentAutomated security testingManual security testingInfrastructure state inspectionMachine Image inspectionPackage and software inventory inspectionVulnerability assessmentAudit configuration inspectionLogging configuration inspectionAccess-control inspectionSecurity finding inspectionSecurity exception inspectionEvidence inspectionProvenance inspectionTraceability inspectionThe verification record identifies:

The selected Security BaselineThe Security Baseline identifier and revisionThe Infrastructure Environment under evaluationThe applicable security requirementsThe security controls associated with each requirementThe evaluation method applied to each requirementThe result for each applicable security requirementEach identified security findingEach approved security exception or deviationThe overall conformance resultThe generated EvidenceThe applicable ProvenanceThe applicable Traceability

Requirements Realized By

This requirement is realized by:

Related Architecture Sections

Referenced By

The following pages reference this requirement:

Delivery Phase

Phase 1 and subsequent phases

Implementation Status

Not Assessed

Implementation status requires evaluation of an Infrastructure Environment created by the current Crucible implementation against the selected Security Baseline.

Requirement Status

Draft

This requirement derives from MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft.

Notes for Editors

This requirement page should retain the stable requirement identifier MO-001d.

This page is a leaf requirement page and omits a trailing :start from its namespace.

Changes to the Statement SHALL preserve the security intent derived from MO-001.

The selected Security Baseline should identify:

The Security Baseline identifierThe Security Baseline revisionThe applicable operational contextThe applicable security requirementsThe associated security controlsThe evaluation criteriaThe permitted exceptions or deviationsThe required EvidenceThe conformance determination criteriaMaterial changes should receive review and should update the related verification criteria, requirements realization, related architecture sections, and source records.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.