FR-COMP-002 — Compliance Scanning Tool Integration

Go to Crucible Compliance Management Requirements

Crucible SHALL integrate with Compliance Scanning Tools.

This requirement derives from:

• Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-002

The Original Requirement states:

The system shall integrate with compliance scanning tools.[C1]

FR-COMP-002:

• Replaces The system with the defined system name Crucible
• Changes shall to the established uppercase normative form SHALL
• Capitalizes Compliance Scanning Tools as the named integration subject

No other substantive normalization is required.

Compliance Scanning Tools evaluate systems, configurations, images, workloads, or other subjects against defined compliance criteria.

Integration allows Crucible to use externally implemented scanning capabilities without incorporating each scanning engine directly into the core Crucible implementation.

An integration can involve:

• Supplying a scan subject
• Supplying a Compliance Baseline
• Initiating a scan
• Supplying scan parameters
• Receiving scan status
• Receiving Compliance Findings
• Receiving scan output
• Receiving generated Evidence

This requirement establishes integration with Compliance Scanning Tools without prescribing:

• A particular Compliance Scanning Tool
• A particular operating system
• A particular scanning standard
• An integration protocol
• A command-line interface
• An application programming interface
• A plugin mechanism
• A data format
• Scan scheduling
• Compliance-report generation
• Preservation of Compliance Findings

Separate requirements, architecture specifications, workflows, or interface definitions govern those subjects and behaviors.

This requirement applies to:

• Crucible
• Compliance Scanning Tools
• Compliance scanning integrations
• Compliance scan operations

Verification confirms that:

1. A Compliance Scanning Tool is selected for testing
2. Crucible exchanges the information required to use the selected Compliance Scanning Tool
3. Crucible initiates or otherwise causes the selected Compliance Scanning Tool to perform a compliance scan
4. Crucible receives an observable result from the selected Compliance Scanning Tool
5. The observed interaction demonstrates integration with the selected Compliance Scanning Tool

The following pages reference this requirement:

Implemented and Verified

Review and approve FR-COMP-002 as a leaf requirement.

Determine whether Compliance Scanning Tool requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether separate requirements define the information exchanged with a Compliance Scanning Tool.

Determine whether separate requirements govern preservation and processing of Compliance Findings returned by a Compliance Scanning Tool.

This requirement page retains the stable requirement identifier FR-COMP-002.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The Statement preserves the approved source intent by requiring Crucible to integrate with Compliance Scanning Tools.

Do not replace integrate with with a narrower behavior such as invoke, execute, load, or receive findings from unless the controlling requirement identifies that specific interaction.

Do not add a particular Compliance Scanning Tool, operating system, scanning standard, protocol, interface, plugin mechanism, data format, scheduling, reporting, or finding-retention obligation unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-002#Statement&noheader&nofooter&noeditbtn}}