FR-COMP-001 — Compliance Baseline Definitions

Go to Crucible Compliance Management Requirements

Crucible SHALL define Compliance Baselines.

This requirement derives from:

• Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-001

The Original Requirement states:

The system shall support compliance baseline definitions.[C1]

FR-COMP-001:

• Replaces The system with the defined system name Crucible
• Changes shall to the established uppercase normative form SHALL
• Replaces the weak verb support with the observable behavior define
• Uses the defined Compliance Baseline concept

No other substantive normalization is required.

A Compliance Baseline identifies a controlled set of compliance criteria used to evaluate a subject.

Defining Compliance Baselines allows Crucible to establish the criteria against which separately governed compliance scanning, assessment, reporting, and evidence-generation activities operate.

A Compliance Baseline can identify:

• Compliance criteria
• Security controls
• Configuration rules
• Evaluation procedures
• Expected values
• Severity classifications
• Applicability conditions
• Required evidence
• References to external compliance frameworks

This requirement establishes definition of Compliance Baselines without prescribing:

• Import of externally defined Compliance Baselines
• Application of a Compliance Baseline
• Compliance scanning
• Compliance assessment
• Compliance reporting
• Generation of compliance Evidence
• A specific compliance framework
• A specific operating system
• A specific scanning tool
• Approval or version-management behavior

Separate requirements, architecture specifications, workflows, or policies define those subjects and behaviors.

This requirement applies to:

• Crucible
• Compliance Baselines
• Compliance Baseline definition operations

Verification confirms that:

1. Compliance criteria are selected for inclusion in a Compliance Baseline
2. Crucible defines a Compliance Baseline containing the selected compliance criteria
3. The resulting Compliance Baseline can be identified
4. The compliance criteria defined by the resulting Compliance Baseline can be determined

The following pages reference this requirement:

Implemented and Verified

Review and approve FR-COMP-001 as a leaf requirement.

Determine whether separate requirements govern Compliance Baseline identifiers, revisions, approval, and lifecycle state.

Determine whether separate requirements govern importing and maintaining externally defined Compliance Baselines.

Determine whether Compliance Baseline Definition requires a separate controlled term or whether Compliance Baseline is sufficient.

This requirement page retains the stable requirement identifier FR-COMP-001.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The Statement preserves the approved source intent by requiring Crucible to define Compliance Baselines.

Do not change define to maintain, import, apply, scan against, or assess against without a corresponding change to the controlling requirement. Each verb establishes a different behavior.

Do not add DISA STIG, FedRAMP, custom-framework, scanning-tool, reporting, Evidence-generation, approval, revision-management, or Compliance Baseline application obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-001#Statement&noheader&nofooter&noeditbtn}}