dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005:start [2026/08/01 06:19] – removed - external edit (Unknown date) 127.0.0.1dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005:start [2026/08/01 06:19] (current) – ↷ Page moved and renamed from dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005 to dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr nick_dido
Line 1: Line 1:
 +====== FR-COMP-005 — DISA STIG Compliance Baselines ======
  
 +[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]
 +
 +===== Statement =====
 +
 +[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL provide [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]] [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]].
 +
 +===== Derived From =====
 +
 +This requirement derives from:
 +
 +  * Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-005
 +
 +The Original Requirement states:
 +
 +> //The system shall support [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|DISA]] [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|STIG]] compliance baselines.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]
 +
 +FR-COMP-005:
 +
 +  * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
 +  * Changes **shall** to the established uppercase normative form **SHALL**
 +  * Replaces the weak verb **support** with **provide**
 +  * Links **DISA**, **STIG**, and **Compliance Baselines** to their controlling definitions
 +  * Preserves DISA STIG as the source-identified compliance framework
 +
 +No other substantive normalization is required.
 +
 +===== Rationale =====
 +
 +The [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]] publishes [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guides (STIGs)]] that provide security configuration guidance and associated evaluation criteria for specified technologies.
 +
 +A DISA STIG [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] enables Crucible compliance activities to use criteria derived from an identified STIG.
 +
 +Such a Compliance Baseline can include:
 +
 +  * Security configuration requirements
 +  * Evaluation criteria
 +  * Expected values
 +  * Severity classifications
 +  * Applicability conditions
 +  * Check procedures
 +  * Remediation guidance
 +  * References to the source STIG
 +  * References to related security controls
 +
 +This requirement establishes provision of DISA STIG Compliance Baselines without prescribing:
 +
 +  * Which STIGs Crucible provides
 +  * A particular STIG revision
 +  * The process used to create or import a Compliance Baseline
 +  * Application of a Compliance Baseline
 +  * Compliance scanning
 +  * Compliance assessment
 +  * Remediation
 +  * Compliance reporting
 +  * Evidence generation
 +  * Automatic updates
 +  * Approval or lifecycle management
 +
 +Separate requirements, architecture specifications, workflows, or policies define those subjects and behaviors.
 +
 +===== Applies To =====
 +
 +This requirement applies to:
 +
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guides (STIGs)]]
 +  * DISA STIG [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baselines]]
 +
 +===== Verification =====
 +
 +Verification confirms that:
 +
 +  - A [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] is selected for testing
 +  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] provides a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] associated with the selected STIG
 +  - The provided Compliance Baseline identifies the DISA STIG from which it derives
 +  - The compliance criteria represented by the provided Compliance Baseline can be determined
 +  - The resulting Compliance Baseline can be identified
 +
 +===== Referenced By =====
 +
 +The following pages reference this requirement:
 +
 +{{backlinks>.#dido:02-crusible}}
 +
 +===== Implementation Status =====
 +
 +Implemented and Verified
 +
 +===== Requirement Status =====
 +
 +<todo>Review and approve FR-COMP-005 as a leaf requirement.</todo>
 +
 +----
 +===== Issues =====
 +
 +<todo>Determine whether separate requirements identify the DISA STIG products and revisions that Crucible must provide.</todo>
 +
 +<todo>Determine whether separate requirements govern importing, updating, approving, and applying DISA STIG Compliance Baselines.</todo>
 +
 +----
 +===== Notes for Editors =====
 +
 +This requirement page retains the stable requirement identifier ''FR-COMP-005''.
 +
 +This page is a leaf requirement page and omits a trailing '':start'' from its namespace.
 +
 +The Statement preserves the approved source intent by requiring Crucible to provide DISA STIG Compliance Baselines.
 +
 +Use the following controlling Terms and Definitions entries:
 +
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:d:disa|Defense Information Systems Agency (DISA)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]
 +
 +Do not change **provide** to **define**, **import**, **maintain**, **apply**, **scan against**, or **assess against** unless the controlling requirement identifies that specific behavior.
 +
 +Do not add a particular STIG, STIG revision, operating system, scanning tool, update mechanism, remediation process, reporting obligation, or Evidence-generation obligation unless the controlling requirement changes through an approved requirements process.
 +
 +To reference this requirement Statement from another wiki page, insert:
 +
 +<code dokuwiki>
 +{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-005#Statement&noheader&nofooter&noeditbtn}}
 +</code>
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>