FR-COMP-008b — Multiple Operating-System Support

Go to FR-COMP-008 — Operating-System-Independent Compliance Scanning

Crucible SHALL evaluate two or more Operating Systems against defined compliance criteria.

This requirement derives from:

• FR-COMP-008 — Operating-System-Independent Compliance Scanning
• Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-008

The Original Requirement states:

The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).[C1]

FR-COMP-008b:

• Extracts the requirement that compliance evaluation is not limited to a single Operating System
• Replaces the negative phrase shall not be limited to a single operating system with the positive and verifiable behavior SHALL evaluate two or more Operating Systems against defined compliance criteria
• Uses two or more Operating Systems as the minimum verifiable threshold for multiple Operating-System support
• Clarifies the purpose of the evaluation by identifying defined compliance criteria
• Assigns provision of the Compliance Scanning Abstraction to FR-COMP-008a
• Excludes the OpenSCAP and RHEL 9 implementation example from the normative Statement

Evaluating only one Operating System would couple Crucible compliance capabilities to a single operating-system environment.

Evaluation of two or more Operating Systems against defined compliance criteria demonstrates that Crucible can perform compliance evaluation across multiple Operating Systems.

The Statement uses evaluate rather than scan because evaluate identifies the intended compliance behavior without prescribing a particular scanning technology, tool, or implementation method.

This requirement establishes the minimum Operating-System coverage without prescribing:

• Particular Operating Systems
• Particular compliance criteria
• A particular Compliance Baseline
• A particular Compliance Scanning Tool
• A particular scanning provider
• Identical evaluation capabilities for every Operating System
• A common Compliance Baseline for every Operating System
• A common result format
• Automatic Operating-System detection
• Provider selection
• Provider installation
• Dynamic provider loading
• Use of OpenSCAP
• Use of Red Hat Enterprise Linux (RHEL)

Separate requirements, architecture specifications, compliance profiles, and interface definitions govern those subjects and behaviors.

This requirement applies to:

• Crucible
• Operating Systems
• Compliance criteria
• Compliance evaluation operations
• Compliance evaluation implementations

Verification confirms that:

1. Two different Operating Systems are selected for testing
2. Compliance criteria are defined for each selected Operating System
3. Crucible evaluates the first selected Operating System against its defined compliance criteria
4. Crucible evaluates the second selected Operating System against its defined compliance criteria
5. Each evaluation produces an observable result

The following pages reference this requirement:

Implemented and Verified

Review and approve FR-COMP-008b as a leaf requirement.

Determine whether Operating System requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether compliance criterion requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether separate requirements identify the Operating Systems that Crucible must evaluate.

Determine whether separate requirements define the minimum compliance criteria for each Operating System.

This requirement page retains the derived requirement identifier FR-COMP-008b.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The namespace for this requirement is:

dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008b

The word Support remains in the page title as the name of the capability. The normative Statement does not use support as its governing verb.

The Statement uses evaluate rather than scan because evaluate against defined compliance criteria identifies the intended compliance behavior more clearly.

The Statement addresses only evaluation of two or more Operating Systems.

FR-COMP-008a governs provision of the Compliance Scanning Abstraction.

The OpenSCAP and RHEL 9 reference in the Original Requirement describes one current implementation and does not create a requirement to use either technology.

Do not add particular Operating Systems, compliance criteria, Compliance Baselines, scanning tools, scanning providers, provider-selection behavior, automatic detection, common result formats, or equivalent evaluation coverage unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-008:fr-comp-008b#Statement&noheader&nofooter&noeditbtn}}