OR-003e — Information Handling Rule Enforcement

Go to OR-003 — Classified and Unclassified Environments

Crucible SHALL prevent an operation from handling information in a manner prohibited by the Information Handling Rules governing that information.

This requirement derives from:

• OR-003 — Classified and Unclassified Environments
• Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003

The Original Requirement states:

The system SHALL support classified and unclassified deployment environments.[C1]

OR-003e isolates the obligation to enforce the Information Handling Rules governing information processed by a Crucible operation.

Authorization to process information within a Security Domain does not authorize every possible action involving that information.

Information Handling Rules can restrict how information is accessed, used, processed, stored, reproduced, transmitted, transferred, retained, archived, downgraded, declassified, sanitized, or destroyed.

OR-003e prevents a Crucible operation from performing an information-handling action prohibited by the rules governing the information.

This requirement applies to:

• Crucible
• Crucible operations
• Information processed by Crucible operations
• Information Handling Rules
• Security Classifications
• Security Domains
• Classified Environments
• Unclassified Environments

Verification confirms that:

1. Each tested information object identifies or resolves to its governing Information Handling Rules
2. Crucible permits a tested operation to perform an information-handling action authorized by the governing Information Handling Rules
3. Crucible prevents a tested operation from performing an information-handling action prohibited by the governing Information Handling Rules
4. Crucible prevents processing when the governing Information Handling Rules cannot be determined
5. Crucible records each denial caused by an Information Handling Rule
6. Each denial record identifies the operation, information object, governing Information Handling Rule, requested action, and denial result

The following pages reference this requirement:

Implemented and Verified.

Assess whether the current Crucible implementation prevents operations from handling information in a manner prohibited by the governing Information Handling Rules.

Review and approve OR-003e as a leaf requirement derived from OR-003.

Define how Crucible associates Information Handling Rules with each information object.

Define how Crucible resolves Information Handling Rules inherited from a Security Classification, Security Domain, source, owner, or governing authority.

Define how Crucible resolves conflicting Information Handling Rules.

Define the behavior required when an information object does not identify or resolve to governing Information Handling Rules.

Define the information-handling actions that Crucible can authorize or prohibit.

Define the record required when Crucible prevents an operation because of an Information Handling Rule.

This requirement page should retain the stable requirement identifier OR-003e.

This page is a leaf requirement page and omits a trailing :start from its namespace.

OR-003e requires enforcement of established Information Handling Rules. It does not require Crucible to establish, approve, or modify those rules.

The responsible authority establishes:

• The information governed by each rule
• The permitted information-handling actions
• The prohibited information-handling actions
• The conditions under which an action is permitted
• The authority required to approve an exception

Changes to the Statement should preserve:

• Crucible as the responsible actor
• Prevention as the required behavior
• A Crucible operation as the subject of enforcement
• Information as the governed object
• The governing Information Handling Rules as the source of the prohibition

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003e#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.