FR-COMP-008 — Operating-System-Independent Compliance Scanning

Go to Crucible Compliance Management Requirements

The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).[C1]

The Original Requirement contains two distinct normative obligations:

1. Provision of a compliance scanning abstraction
2. Compliance scanning across more than one operating system

These obligations require separate verification and therefore should be represented by separate leaf requirements.

The parenthetical reference to the current OpenSCAP and RHEL 9 integration identifies an implementation example. It does not establish an additional normative obligation and should not appear in a child requirement Statement.

The phrase operating-system-agnostic is replaced with operating-system-independent to align the requirement title and avoid implying complete absence of operating-system-specific implementation components.

Review and approve the decomposition of FR-COMP-008.

Create and approve FR-COMP-008a.

Create and approve FR-COMP-008b.

Determine whether Compliance Scanning Abstraction requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether Operating System requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether the minimum of two operating systems accurately expresses the intended portability threshold.

This page is a non-leaf requirement page and therefore retains a trailing :start in its namespace.

The child requirements are leaf pages and omit a trailing :start from their namespaces.

The OpenSCAP and RHEL 9 reference describes one implementation of the abstraction and does not create a requirement to use either technology.

Do not add requirements for dynamic provider loading, plugin discovery, provider registration, common result formats, or automatic operating-system detection unless the controlling source adds those obligations.