FR-COMP-008a — Compliance Scanning Abstraction

Go to FR-COMP-008 — Operating-System-Independent Compliance Scanning

Crucible SHALL provide a Compliance Scanning Abstraction.

This requirement derives from:

• FR-COMP-008 — Operating-System-Independent Compliance Scanning
• Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-008

The Original Requirement states:

The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).[C1]

FR-COMP-008a:

• Replaces The system with the defined system name Crucible
• Changes shall to the established uppercase normative form SHALL
• Retains the direct behavior provide
• Extracts provision of the Compliance Scanning Abstraction as an independently verifiable requirement
• Assigns operating-system coverage to FR-COMP-008b
• Excludes the OpenSCAP and RHEL 9 implementation example from the normative Statement

A Compliance Scanning Abstraction separates Crucible compliance scanning operations from a particular scanning tool or operating-system-specific implementation.

The abstraction allows Crucible to use different compliance scanning implementations through a common architectural boundary.

This requirement establishes provision of the abstraction without prescribing:

• A particular Compliance Scanning Tool
• A particular operating system
• A particular provider
• A plugin mechanism
• A provider discovery mechanism
• An application programming interface
• A command-line interface
• A data exchange format
• A common Compliance Finding format
• Dynamic provider loading
• Automatic operating-system detection

Separate requirements, architecture specifications, and interface definitions govern those subjects and behaviors.

This requirement applies to:

• Crucible
• Compliance scanning operations
• Compliance scanning implementations
• Compliance Scanning Tools

Verification confirms that:

1. A compliance scanning operation is selected for testing
2. Two compliance scanning implementations are configured behind the Compliance Scanning Abstraction
3. Crucible initiates the selected compliance scanning operation through the Compliance Scanning Abstraction
4. The selected compliance scanning operation can use either configured implementation without changing the Crucible operation that invokes the abstraction
5. Each configured implementation returns an observable scanning result through the abstraction

The following pages reference this requirement:

Implemented and Verified

Review and approve FR-COMP-008a as a leaf requirement.

Determine whether Compliance Scanning Abstraction requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether the architecture defines the operations and information exposed by the Compliance Scanning Abstraction.

This requirement page retains the derived requirement identifier FR-COMP-008a.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The Statement addresses only provision of the Compliance Scanning Abstraction.

FR-COMP-008b governs compliance scanning across two or more operating systems.

The OpenSCAP and RHEL 9 reference in the Original Requirement describes one implementation of the abstraction and does not create a requirement to use either technology.

Do not add provider loading, provider discovery, plugin registration, operating-system detection, interface protocol, data-format, or result-normalization obligations unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008a#Statement&noheader&nofooter&noeditbtn}}