| Next revision | Previous revision |
| dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e [2026/07/20 07:59] – created nick_dido | dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001e [2026/07/30 05:21] (current) – [Delivery Phase] nick_dido |
|---|
| ===== Statement ===== | ===== Statement ===== |
| |
| [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL create an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] in [[dido:99_annexes:annex-b-terms-and-definitions:c:conformance|conformance]] with the selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. | [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL create an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] that conforms to the selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. |
| |
| ===== Derived From ===== | ===== Derived From ===== |
| > //Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] | > //Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] |
| |
| MO-001e preserves the portion of the Original Requirement that characterizes an Infrastructure Environment as **compliant**. | MO-001e preserves the portion of the Original Requirement that characterizes Infrastructure Environments as **compliant** by requiring each created Infrastructure Environment to conform to the selected Compliance Baseline. |
| |
| The separate requirements derived from MO-001 address: | The separate requirements derived from MO-001 address: |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c|MO-001c — Reproducibility]] | * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c|MO-001c — Reproducibility]] |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d|MO-001d — Security Baseline Conformance]] | * [[dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001d|MO-001d — Security Baseline Conformance]] |
| |
| ===== Assessment ===== | |
| |
| The Original Requirement uses **compliant** without identifying: | |
| |
| * The applicable compliance requirements | |
| * The controlling Compliance Baseline | |
| * The criteria used to determine satisfaction of the applicable requirements | |
| * The assessment methods applied to the Infrastructure Environment | |
| * The Evidence required to support the determination | |
| * The treatment of Compliance Findings, exceptions, or deviations | |
| |
| The term **compliant** describes a desired condition but does not establish an objectively verifiable requirement. | |
| |
| MO-001e: | |
| |
| * Replaces **compliant** with conformance to an identified Compliance Baseline | |
| * Identifies [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor | |
| * Identifies the created [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] as the subject of conformance | |
| * Identifies the selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] as the controlling source of compliance requirements | |
| * Separates Compliance Baseline conformance from Infrastructure Environment creation, deployment duration, reproducibility, and security outcomes | |
| |
| ===== Rationale ===== | ===== Rationale ===== |
| |
| A general claim that an Infrastructure Environment is compliant does not identify the requirements the environment satisfies. | The word **compliant** does not establish an objective compliance obligation unless a controlling Compliance Baseline identifies the requirements and conformance criteria used for evaluation. |
| |
| A selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] establishes the applicable requirements, assessment criteria, evaluation methods, required [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]], and conformance determination criteria for a defined operational context. | The selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] provides the controlled compliance requirements against which the created Infrastructure Environment is evaluated. |
| |
| Compliance Baselines can address: | Compliance Baseline conformance supports: |
| |
| * Statutory requirements | * Consistent application of compliance requirements |
| * Regulatory requirements | * Objective evaluation of the created Infrastructure Environment |
| * Contractual requirements | * Identification of unmet or incorrectly implemented requirements |
| * Organizational policies | * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] generation |
| * Technical standards | * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] |
| * Configuration standards | * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] |
| * Security implementation guidance | * Independent review of compliance outcomes |
| * Operational controls | |
| * Documentation requirements | |
| * Evidence requirements | |
| * Reporting requirements | |
| * Retention requirements | |
| * Traceability requirements | |
| * Approval requirements | |
| |
| The selected Compliance Baseline provides the reference against which the Infrastructure Environment is evaluated. | Separating Compliance Baseline conformance from Infrastructure Environment creation permits Crucible to create an Infrastructure Environment while independently passing or failing the compliance requirement. |
| |
| Conformance requires satisfaction of the applicable requirements established by the selected Compliance Baseline. Selection of a Compliance Baseline, execution of a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_assessment|Compliance Assessment]], or generation of Evidence does not alone establish conformance. | This requirement does not establish a deployment-duration threshold, reproducibility criterion, or [[dido:99_annexes:annex-b-terms-and-definitions:s:security_baseline|Security Baseline]]. The other requirements derived from MO-001 address those outcomes. |
| | |
| Separating Compliance Baseline conformance from MO-001a permits Crucible to create an Infrastructure Environment successfully while independently passing or failing the applicable compliance requirements. | |
| | |
| This requirement does not establish the applicable Security Baseline. MO-001d addresses Security Baseline conformance. | |
| |
| ===== Applies To ===== | ===== Applies To ===== |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:conformance|Conformance]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environments]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environments]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_assessment|Compliance Assessments]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] | |
| * Compliance requirements | * Compliance requirements |
| * Compliance controls | * Compliance evaluation |
| * Compliance criteria | * Compliance findings |
| * Compliance exceptions | |
| * Compliance deviations | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:controlled_input|Controlled Inputs]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:controlled_input|Controlled Inputs]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:d:declarative_description|Declarative Descriptions]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible_description|Crucible Descriptions]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baselines]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline_composition|Baseline Composition]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_configuration|Infrastructure Configurations]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] | * [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Images]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_configuration|Infrastructure Configurations]] | * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_deployment|Infrastructure Deployments]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_plane|Security Plane]] | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] | * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] | * [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] | * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environments]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environments]] |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:a:air-gapped_environment|Air-Gapped Environments]] |
| |
| ===== Verification ===== | ===== Verification ===== |
| Verification confirms that: | Verification confirms that: |
| |
| - The selected Compliance Baseline is uniquely identified | - The selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] is identified |
| - The selected Compliance Baseline identifies the requirements applicable to the Infrastructure Environment | - The Compliance Baseline identifies the compliance requirements and conformance criteria used for evaluation |
| - The Infrastructure Environment is evaluated against each applicable requirement | - The created [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] is evaluated against the selected Compliance Baseline |
| - Each applicable requirement has a recorded result | - Each required compliance requirement is evaluated |
| - The Infrastructure Environment satisfies the conformance criteria established by the selected Compliance Baseline | - The created Infrastructure Environment satisfies the conformance criteria defined by the selected Compliance Baseline |
| - Each identified Compliance Finding, exception, or deviation is recorded | - Any compliance finding is identified and associated with the affected compliance requirement |
| - The generated Evidence supports the conformance determination | - The verification record preserves [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] among the selected Compliance Baseline, the evaluated compliance requirements, the created Infrastructure Environment, and the evaluation result |
| | |
| Verification includes: | |
| | |
| * Compliance Baseline inspection | |
| * Compliance requirement inspection | |
| * Compliance control inspection | |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_assessment|Compliance Assessment]] | |
| * Automated compliance testing | |
| * Manual compliance testing | |
| * Infrastructure state inspection | |
| * Machine Image inspection | |
| * Package and software inventory inspection | |
| * Configuration inspection | |
| * Documentation inspection | |
| * Evidence inspection | |
| * Compliance Finding inspection | |
| * Compliance exception inspection | |
| * Provenance inspection | |
| * Traceability inspection | |
| | |
| The verification record identifies: | |
| | |
| - The selected Compliance Baseline | |
| - The Compliance Baseline identifier and revision | |
| - The Infrastructure Environment under evaluation | |
| - The applicable compliance requirements | |
| - The controls associated with each requirement | |
| - The evaluation method applied to each requirement | |
| - The result for each applicable compliance requirement | |
| - Each identified [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] | |
| - Each approved compliance exception or deviation | |
| - The overall conformance result | |
| - The generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] | |
| - The applicable [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] | |
| - The applicable [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] | |
| | |
| ===== Requirements Realized By ===== | |
| | |
| This requirement is realized by: | |
| | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-002|OR-002 — Deployment Environments]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003|OR-003 — Classified and Unclassified Environments]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-01-configuration-management:start|FR-CFG-001 through FR-CFG-005]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-02-image-management:start|FR-IMG-001 through FR-IMG-006]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-03-deployment-orchestration:start|FR-DEP-001 through FR-DEP-007]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:start|FR-AG-001 through FR-AG-005]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|FR-COMP-001 through FR-COMP-010]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-08-devsecops-integration:start|FR-DSO-001 through FR-DSO-006]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-09-baseline-composition-and-workspace:start|FR-BAS-001 through FR-BAS-004]] | |
| * [[dido:02-crusible:99-annexes:annex-c-requirements:13-key-value-proposition-requirements:kvp-004|KVP-004 — Improve Compliance Consistency]] | |
| | |
| ===== Related Architecture Sections ===== | |
| | |
| * [[dido:02-crusible:05-descriptions-composition-and-baselines:start|5. Descriptions, Composition, and Baselines]] | |
| * [[dido:02-crusible:06-machine-images-and-image-layers:start|6. Machine Images and Image Layers]] | |
| * [[dido:02-crusible:07-infrastructure-and-deployment:start|7. Infrastructure and Deployment]] | |
| * [[dido:02-crusible:08-dependencies-and-air-gap-operations:start|8. Dependencies and Air Gap Operations]] | |
| * [[dido:02-crusible:09-compliance-and-security:start|9. Compliance and Security]] | |
| * [[dido:02-crusible:10-reproducibility-provenance-and-traceability:start|10. Reproducibility, Provenance, and Traceability]] | |
| |
| ===== Referenced By ===== | ===== Referenced By ===== |
| ===== Delivery Phase ===== | ===== Delivery Phase ===== |
| |
| Phase 1 and subsequent phases | Implemented and Verified |
| |
| ===== Implementation Status ===== | ===== Implementation Status ===== |
| |
| Not Assessed | <todo>Assess whether the current Crucible implementation creates Infrastructure Environments that conform to the selected Compliance Baseline.</todo> |
| | |
| Implementation status requires evaluation of an Infrastructure Environment created by the current Crucible implementation against the selected Compliance Baseline. | |
| |
| ===== Requirement Status ===== | ===== Requirement Status ===== |
| |
| Draft | <todo>Review and accept MO-001e as a proposed derived requirement created from the evaluation and decomposition of MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft.</todo> |
| |
| This requirement derives from MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft. | ---- |
| | ===== Issues ===== |
| | |
| | The following unresolved issues affect this requirement: |
| | |
| | <todo>Identify the controlling source that selects the Compliance Baseline for each Infrastructure Environment.</todo> |
| | |
| | <todo>Identify the compliance requirements and conformance criteria that determine Compliance Baseline conformance.</todo> |
| | |
| | <todo>Define how exceptions, deviations, waivers, and compensating measures affect Compliance Baseline conformance.</todo> |
| | |
| | <todo>Define whether an Infrastructure Environment with unresolved compliance findings can satisfy this requirement.</todo> |
| |
| ---- | ---- |
| This page is a leaf requirement page and omits a trailing '':start'' from its namespace. | This page is a leaf requirement page and omits a trailing '':start'' from its namespace. |
| |
| Changes to the Statement SHALL preserve the compliance intent derived from MO-001. | The parent MO-001 page is a non-leaf page and retains a trailing '':start'' in its namespace. |
| | |
| | Changes to the Statement should preserve: |
| |
| The selected Compliance Baseline should identify: | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor |
| | * Creation of an [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_environment|Infrastructure Environment]] as the required outcome |
| | * The selected [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] as the controlling compliance source |
| | * Conformance to the selected Compliance Baseline as the required compliance outcome |
| |
| * The Compliance Baseline identifier | The unresolved Compliance Baseline selection and conformance criteria should remain recorded in the Issues section until a controlling source resolves them. |
| * The Compliance Baseline revision | |
| * The applicable operational context | |
| * The applicable compliance requirements | |
| * The associated controls | |
| * The evaluation criteria | |
| * The permitted exceptions or deviations | |
| * The required Evidence | |
| * The conformance determination criteria | |
| |
| Material changes should receive review and should update the related verification criteria, requirements realization, related architecture sections, and source records. | Material changes should receive review and should update the verification criteria, source records, and Issues section. |
| |
| To reference this requirement Statement from another wiki page, insert: | To reference this requirement Statement from another wiki page, insert: |